Global teams of security researchers compete in first on-orbit hacking competition

The Department of the Air Force has made history with a successful and first-of-its-kind capture-the-flag hacking competition on an operational satellite. Hack-A-Sat 4 took place Aug. 11-12 in the Aerospace Village at the annual hacking conference DEF CON 31 in Las Vegas, Nevada.

In its fourth year, Hack-A-Sat is an opportunity for a global community of cyber security researchers to hack and learn in an open and collaborative online environment with the goal of improving the security and resilience of space systems. Each year Hack-A-Sat has advanced the technology supporting the game from FlatSat hardware to a Digital Twin software simulation to this year's on-orbit 3U CubeSat called Moonlighter.

Hack-A-Sat 4 winning team ‘mHACKeroni’ displays their banner and shows off their award for capturing first place during the two-day competition. Hack-A-Sat 4 was the first capture-the-flag hacking competition on an operational satellite held Aug. 11-12 in the Aerospace Village at the annual hacking conference DEF CON 31 in Las Vegas, Nevada. (Photo by Sarah McNulty, Space Systems Command)

Designed and built by The Aerospace Corporation in partnership with Space Systems Command (SSC), Moonlighter was created specifically for cyber exercises to advance security researcher knowledge and skills in securing space systems. Moonlighter launched June 5 to the International Space Station as part of the SpX-28 commercial resupply mission. It was deployed into low Earth orbit on July 6 and was commissioned just in time for its first mission to host the Hack-A-Sat 4 final event.

“We are so proud of the entire Hack-A-Sat effort and particularly the development of Moonlighter as the first and only hacking sandbox in space,” said Col. Neal Roach, director of Engineering and Integration for Space Domain Awareness and Combat Power, SSC. “Hack-A-Sat has raised public awareness on the importance of space cybersecurity and has helped to strengthen the industry, security and government partnership that we need to build more resilient space systems that will keep our nation and our world secure.”

The Hack-A-Sat 4 final event featured five of the world’s most accomplished capture-the-flag cyber security research teams competing through two ground-based challenges and seven on-orbit challenges testing their space-relevant skills including spacecraft operations, radio frequency communications and reverse engineering.

The top three teams earned cash prizes as follows:

$50,000 1st place: mHACKeroni

$30,000 2nd place: Poland Can Into Space

$20,000 3rd place: jmp fs:[rcx]

Team ‘Poland Can Into Space’ attempts to hack the Moonlighter during the Hack-A-Sat 4 competition Aug. 11-12 in the Aerospace Village at the annual hacking conference DEF CON 31 in Las Vegas, Nevada. Hack-A-Sat 4 was the first capture-the-flag hacking competition on an operational satellite called Moonlighter, which was designed by The Aerospace Corporation, in partnership with Space Systems Command and the Air Force Research Laboratory, to advance cybersecurity for space systems. (Photo by Sarah McNulty, Space Systems Command)

The final five teams were the top finishers out of more than 700 teams competing in the virtual Hack-A-Sat 4 qualification round in April.

“Playing Hack-A-Sat, for me, is like challenging myself to understand better a problem space that is amazingly complex and extremely exciting,” said a member of the Italian team mHACKeroni who won the finals. “Doing that for security, which I am extremely excited about, is like a dream come true.”

During the final event weekend, DEF CON 31 attendees had the opportunity to learn about the Hack-A-Sat program, including its purpose, history, and technology. They also received game updates and analysis at the dedicated Hack-A-Sat talks on the Aerospace Village stage. DEF CON attendees were able to watch the teams compete and track the scoring and satellite orbit in the Hack-A-Sat contest area. Those who didn’t attend DEF CON 31 followed the competition on X (formerly Twitter) and hackasat.com where they could check the scoreboard, satellite orbit, and watch the recorded Hack-A-Sat talks.

For more information visit: www.hackasat.com.