Italian hackers win on-orbit satellite hack challenge

The contest attracted more than 700 teams of cyber researchers in the qualifying round in April. Only five teams made it to the final round in August, which consisted of two ground-based challenges and seven on-orbit challenges that tested the hackers' skills in spacecraft operations, radio frequency communications, and reverse engineering.

The hackers had to hack into a small CubeSat, known as Moonlighter, developed by the Aerospace Corporation and the US Air Force Research Laboratory and launched on June 5, 2023. The hackers had to establish a data link with the satellite, take a picture of a ground target of their choice, download it to a ground station, and bypass the satellite's blocks on imaging certain ground targets.

The hackers also had to defend their systems from other teams by using encryption and firewall protections. The satellite was moving at about five miles per second, making the hacking even more challenging.

In the earlier versions of Hack-A-Sats, the competitors were allowed to use ground-based satellite simulations and then, on a laboratory digital twin of the Moonlighter satellite, performed what is known in cybersecurity circles as a “capture the flag (CTF)” contest to find text strings, called “flags,” that are hidden in purposefully-malware programs or websites.

Winners

The winning team was mHACKeroni, a group of five Italian cyber research teams. They won $50,000 for their hacking skills. The second place went to Poland Can Into Space, a Polish cyber research team that won $30,000. The third place was taken by jmp fs:[rcx], a joint British-American team that won $20,000.

“Playing Hack-A-Sat, for me, is like challenging myself to understand better a problem space that is amazingly complex and extremely exciting,” said a member of the Italian team mHACKeroni, who won the finals. “Doing that for security, which I am extremely excited about, is like a dream come true.”

“We are so proud of the entire Hack-A-Sat effort and particularly the development of Moonlighter as the first and only hacking sandbox in space,” said Col. Neal Roach, director of Engineering and Integration for Space Domain Awareness and Combat Power, SSC, in a press release. “Hack-A-Sat has raised public awareness on the importance of space cybersecurity and has helped to strengthen the industry, security, and government partnership that we need to build more resilient space systems that will keep our nation and our world secure.” 

The US Air Force and Space Force hope that by hosting competitions like Hack-A-Sat, they can identify vulnerabilities and gaps in their satellite systems that could be exploited by adversaries such as China. China is reportedly developing capabilities to deny, exploit or hijack enemy satellites, according to a leaked intelligence report. The US military relies on satellites for many critical functions, such as navigation, communication, intelligence, and missile guidance.