Hack-A-Sat: Four Years from the Cromulence Tech Team

In the Spring of 2020, over 6,000 security researchers, aerospace engineers, and space enthusiasts participated in the first Hack-A-Sat Qualification Round for a chance to hack on space hardware and have their solutions uploaded to an on-orbit satellite. Subsequent years introduced increasingly complex flat sats, space environment simulations, and digital twins as targets for teams to attack and defend. Fast forward to 2023 and Hack-A-Sat continues to be the premier space hacking capture-the-flag (CTF) event, culminating with an on-orbit target satellite, Moonlighter. Competitors require skills in reverse engineering, exploitation, satellite operations, satellite communications, cryptography, and space math to succeed. As the technical team behind the scenes building the CTF, Cromulence has designed and built the underlying hardware, digital twins, flight software, vulnerabilities, and game infrastructure for each event. As the game admins, the Cromulence team also has unique insights into the game environment to observe competitor actions, award points for successful exploits and solves, and manage the overall game flow. This technical paper will cover a brief history of Hack-A-Sat from its beginning, describing the evolution of the game environment, digital twins, and the game’s underlying technologies with emphasis on the most recent Hack-A-Sat 3 and 4 events. While Hack-A-Sat 1 and 2 employed a hardware-intensive, flatsat-centered approach, Hack-A-Sat 3 pivoted to digital twins and a high-fidelity shared simulation environment. Lastly, Hack-A-Sat 4 was architected to be the first ever on-orbit CTF, using live commercial ground network links and with challenges residing on-board the orbiting Moonlighter spacecraft. Major challenges and scoring events across the competitions will be covered, detailing competitor approaches and highlighting unexpected tactics. As a public event open to participants from around the world, Hack-A-Sat provides a unique platform for increasing awareness of space systems cybersecurity, bridging the cybersecurity and aerospace communities, and providing real-world exposure to the challenges of securing space systems.