Skip to main content
Move the World.
hacking satellites

Lead Image © NASA

There's a lot of windows open on Amie D.D.'s screen right now — like, an anxiety-inducing, CPU-crushing number of windows: YouTube, TeamViewer, Google Drive, Slack, a virtual machine running Cosmos, and (of course) Discord.

It's like looking into the brain of a colonial organism: text and voices, flying past lines of white code — the eyes and ears and thoughts of an entire team spread over thousands of miles and time zones.

The software engineer is the namesake of team ADDVulcan, a cosmopolitan collection of hackers spanning hemispheres, from the U.S. to the Philippines.

From their command mission control in Detroit — on the walls, a bat colony of hacker convention badges, a taxi cab-colored banner from Car Hacking Village, a flag of the United Federation of Planets — team ADDVulcan is fighting to win the Space Security Challenge 2020 (a.k.a. Hack-A-Sat), and while the cash prizes are nice, the real target is nothing less than the moon.

Specifically, shooting a photo of the moon.

With a hijacked satellite.

In orbit.

Space: the Final Cyber Frontier

Hack-A-Sat is part of this year's DEF CON, the famed hacker convention which has been (somewhat ironically) pushed online due to a virus.

Put on by the Air Force and Defense Digital Service (DDS), the game's premise is simple: it's Capture the Flag (CTF).

The narrative? Bad actors have taken over a satellite's ground station, locking the owners out and sending the satellite spiraling. The teams must regain access to the ground station, restore communication, halt the spin, get the payload module back online, and prove control by turning the satellite in orbit, so that it can take a clear and literal moonshot. Simple.

Over 2,000 teams competed for a shot at this challenge in May, chasing flags across a Jeopardy!-like array of contests, accruing points with each capture. In the end, eight were selected to compete in the finals, from August 7-8, where they discovered the moonshot CTF.

The contest is part of a blossoming relationship between the Air Force and the hacker community. Previously, the military's primary means of cyber defense was simply being fairly inaccessible — "security through obscurity," as Brett Goldstein, director of the Defense Digital Service (DDS), put it in his keynote.

But now, the Air Force is taking a more proactive approach: opening up systems and hardware to hackers in an attempt to discover vulnerabilities before their adversaries.

"The military is here to learn," said Will Roper, the Air and Space Forces' acquisition chief and Goldstein's keynote companion.

The contest is a premier example of DEF CON's Aerospace Village in action, says village founder Pete Cooper. Its mission is to get hackers and the various stakeholders — from the worlds of defense, manufacturing, and cybersecurity — together to build the satellite and space security that an increasingly in-orbit future will demand.

"It's easier to do that if you've got really great stuff to bring people to the table and get them excited," he says — and hacking satellites is a pretty cool carrot. (Cooper, with a background both in cybersecurity and as a fighter jet pilot in the Royal Air Force, is uniquely qualified for his role.)

For Amie and the other members of ADDVulcan, the draw was irresistible. The fact that all the answers will need to be published publicly helped offset concerns about working with the armed forces (and for some of the team members, working with the military of a different nation). It's not as if the USAF will be garnering secret knowledge for hacking satellites — or other potentially questionable purposes.

"We could be setting a standard for what space security is," says Amie D.D. "I want the world to be better than I left it, or I want my work to contribute something to someone, or inspire someone enough to do something."

A myriad of everyday necessities — from GPS to NFL Sunday Ticket to the internet itself — come to us courtesy of satellites. (Not to mention their defense applications, like spying and enforcing arms treaties.) As our reliance on satellites increases, and as the battle over cyberspace bleeds over into actual space, it will be crucial, as Hack-A-Sat's mythos puts it, to "secure the last cyberfrontier."

The Finals

From the jump, the finals were a horse of a different color. The last eight hacking teams were not only working with software, like in the qualifying rounds: mini model satellites, called flatsats, added a crucial hardware component. Each team had a personal flatsat to work on, with their solutions then being sent to the competition organizer's flatsats remotely — a simulacra of the gap from ground to orbit.

With all the flatsats needing to balance their battery power consumption and the time to recharge, the contest could no longer run at all hours — effectively neutralizing ADDVulcan's ability to pass the baton around the world and have someone, somewhere constantly working on challenges.

Perhaps even more challenging was the shift to a serial challenge structure — problems had to be solved sequentially, so you couldn't work on multiple issues simultaneously. Each team would have to complete the six challenges in order. But the first team to complete a challenge would flip the hourglass on their competitors, who then had two hours to find their own solution, as the points for solving it dwindled down to zero.

The Air Force is opening up systems and hardware to hackers to discover vulnerabilities before their adversaries.

"It threw us off a little bit," says team lead Will Caruana. Hours of work could be undone, never mind the psychological impact of needing to solve the challenge for no points.

The final challenge rose (literally) above the others: the on-orbit challenge. This required teams to craft a mission plan to be sent to the real satellite, commanding it to rotate and snap a photo of the moon. The teams were judged on how good their mission plan was, as well as how fast they dispatched it. This challenge was pass/fail, and mandatory for the cash prize — Solar Wine, the team who actually scored the most points, failed, costing them the podium.

Six of the final eight teams solved the on-orbit challenge — but only one team's answer would make it to the heavens.

While ADDVulcan struggled on the scoreboard — their team's breadth of knowledge and round-the-clock capabilities neutralized by the serial structure — the on-orbit challenge gave them something to cheer about.

"I jumped on that right away," says Zach "funsized" Pahle.

When the on-orbit challenge window opened, Pahle lept to create a Discord channel dedicated to the real satellite. "All the super-smart dudes in the channel jumped on," Pahle says. "I was definitely the dumbest in the room, but we had so much fun piecing all those different bits together."

hacking satellites

Team ADDVulcan's namesake, software developer, hacker, and Lego Master Amie D.D. Credit: Amie D.D.

It paid off: ADDVulcan's on-orbit solution was accepted.

"We got second most accurate," Amie D.D. says.

With Solar Wine disqualified from the cash prize, team PFS took the Hack-a-Sat crown, with Poland Can Into Space and FluxRepeatRocket a distant second and third. While a win would have been great — and their code being beamed into orbit even better — all nine members of ADDVulcan Freethink spoke to said they valued most the community they built and the chance to expand their knowledge into computer programs, devices, and fields they'd never explored before (like astrophysics and orbital mechanics).

"It's a bigger team, it's more diverse," says shipcod3, a security operations manager for Bugcrowd in the Philippines. "I really think it's the coolest team I've played with since ... ever ... I learned a lot."

The Moonshot

It's a modest image at first glance, a white circle interrupted by an obtuse angled shadow, a pallid Pac-Man, mid-death throes.

Shot by a camera whipping 35,000km above the Earth, directed not by a space agency but a team of hackers, the moonshot symbolizes Poland Can Into Space's eponymous goal. And perhaps the rise of a new era of satellite security.

Editor's note: This article was updated on 8/11/20 to correct a handle; Zach Pahle's handle is "funsized," not "funsize."

We'd love to hear from you! If you have a comment about this article or if you have a tip for a future Freethink story, please email us at [email protected]

Up Next

Hacking
Ethical Hacking Challenge: Can You Take Over a Military Satellite?
Ethical Hacking
Hacking
Ethical Hacking Challenge: Can You Take Over a Military Satellite?
The U.S. Air Force is hosting Hack-A-Sat, an ethical hacking competition challenging participants to find security vulnerabilities in satellite systems.

The U.S. Air Force is hosting Hack-A-Sat, an ethical hacking competition challenging participants to find security vulnerabilities in satellite systems.

Meet the Amateur Astronomer Who Found a Lost NASA Satellite
Meet the Amateur Astronomer Who Found a Lost NASA Satellite
Watch Now
Meet the Amateur Astronomer Who Found a Lost NASA Satellite
A $130 million satellite vanished. Over a decade later, a blogger/astronomer found it.
Watch Now

Amateur astronomer Scott Tilley made international headlines when he rediscovered NASA’s IMAGE satellite, 13 years after it mysteriously disappeared. In this interview with Freethink, Scott discusses his role in the satellite’s recovery, why he enjoys amateur astronomy, and how citizen scientists like him have contributed to our knowledge of space from the space race to the present day.

Coded
The Hackers Exposing Government-Wide Crime and Corruption
The Hackers Exposing Government-Wide Crime and Corruption
Coded
The Hackers Exposing Government-Wide Crime and Corruption
Displaying the power of unique technological abilities combined with dogged investigative journalism
By Michael O'Shea

Displaying the power of unique technological abilities combined with dogged investigative journalism

Hacking for Good
White Hat Hackers are Defending Hospitals From Rising Cyber Attacks
cyber attacks
Hacking for Good
White Hat Hackers are Defending Hospitals From Rising Cyber Attacks
Criminals are exploiting COVID-19 to launch cyber attacks. These volunteers have grouped together to fight back.

Criminals are exploiting COVID-19 to launch cyber attacks. These volunteers have grouped together to fight back.

Future of Tech
Society Runs on GPS. What Happens When it Gets Hacked?
loran
Future of Tech
Society Runs on GPS. What Happens When it Gets Hacked?
GPS runs more than you’d think. It’s also more vulnerable than you’d think. The old-school radionavigation system Loran could save GPS from catastrophe.

GPS runs more than you’d think. It’s also more vulnerable than you’d think. The old-school radionavigation system Loran could save GPS from catastrophe.

Computer Science
Is Quantum Hacking the Biggest Threat to Encryption?
Quantum Hacking
Computer Science
Is Quantum Hacking the Biggest Threat to Encryption?
While some security experts prepare for quantum hacking, others argue that the EARN IT Act is the threat to encryption we need to address right now.

While some security experts prepare for quantum hacking, others argue that the EARN IT Act is the threat to encryption we need to address right now.

Digital Detectives
An Invite to Hack Voting Machines
voting machines
Digital Detectives
An Invite to Hack Voting Machines
Voting machines may have security vulnerabilities, so the largest supplier is inviting pro hackers to find them.

Voting machines may have security vulnerabilities, so the largest supplier is inviting pro hackers to find them.

Coded
The Unhackable Email Service
The Unhackable Email Service
Watch Now
Coded
The Unhackable Email Service
Edward Snowden’s email service of choice wants to make mass surveillance obsolete.
Watch Now

Ladar Levison’s email service counted Edward Snowden among its users. But, when the FBI demanded Levison hand over Snowden’s communications, Levison destroyed the company’s servers. Now, he’s back with a more secure version of the service that could make mass surveillance obsolete.

Digital Detectives
Hackers Find Missing People for Fun
Hackers Find Missing People for Fun
Watch Now
Digital Detectives
Hackers Find Missing People for Fun
This search and rescue expert discovered that many missing people had nobody looking for them. Then he had an idea: what if hackers made a game out of finding missing people through the internet?
Watch Now

One unfortunate truth that anyone involved in a missing person case quickly learns is that there are more missing people in the world than there are available resources to find them. The first few days after a person goes missing are the most crucial for finding them safe and sound. However, since missing people tend to turn up on their own, these cases are initially given low priority. The exception is if there's a strong...