Space Systems Security Challenge

ESA is happy to announce that in the context of 2024 Security for Space Systems (3S) conference, a hands-on security challenge is organised focusing on the security of space systems, inviting Bachelor, Master and PhD students to participate.

The 2024 3S Space Systems Security Challenge is an unparalleled opportunity for individuals passionate with space security to engage in a hands-on, practical challenge. The event is designed to engage participants in the critical aspects of space communication and cybersecurity, reflecting real-world satellite communication challenges, providing a profound learning and competitive environment. It offers a platform for skill enhancement, and demonstration of expertise in a specialized and rapidly advancing field. It bridges the gap between theoretical knowledge and hands on experience in the realm of space security.

The heart of the challenge is a real flat-sat, providing a tangible, space specific practical experience.

This challenge stands out as the first of its kind to comprehensively cover all layers from RF communication to onboard data handling systems security in a space context. It requires participants to navigate through multiple topics of satellite communication and security, starting from the very basics of RF signalling to the intricate processes of Telecommand (TC) and Telemetry (TM), and finally to the onboard data handling systems. It is an end-to-end exercise in satellite hacking, encompassing every aspect of a real-world space security system.

Results of the Online Qualification Event

We are thrilled to share an update on the highly anticipated 2024 3S Space Systems Security Challenge, a cornerstone event of the 2024 Security for Space Systems (3S) conference.

We were happy to see a very promising for the future of space security turnout, with 17 teams registering to take on the challenge, demonstrating the keen interest and dedication within the global academic community towards advancing space systems security. Teams hailed from a diverse range of ESA member states, showcasing a rich variety of backgrounds and expertise.

The qualification phase was fiercely competitive, with teams putting their skills to the test against a series of demanding cybersecurity for space systems tasks. Of the participating teams, 4 teams excelled, solving all the challenges presented to them. An additional 8 teams made significant progress, solving some but not all of the challenges, indicative of the high level of engagement and effort all participants brought to the competition.

We are proud to announce the finalists who will be advancing to the final round of the challenge:

Chalmers Technical Flagcatchers from Sweden, representing Chalmers University of Technology
ENOFLAG from Germany, showcasing talent from Technische Universität Berlin
main() sequence also from Germany, with team members from University of Stuttgart
Fibonhack from Italy, bringing together students from Università di Pisa

These teams not only demonstrated exceptional technical skills but also innovative thinking critical for addressing the complex security needs of space systems.

We extend our heartfelt congratulations to the finalists and our sincere thanks to all teams who participated. Your enthusiasm and contributions have made this challenge a vibrant and meaningful event, and we hope that this challenge has been a useful learning experience for all of you,

The Space Systems Security Challenge organisation committee will contact the finalists for the required arrangements for their participation to the finals.

For any inquiries, please feel free to contact the organisation committee at security4space@esa.int

Required Competences

Participants are expected to demonstrate an in-depth knowledge in cybersecurity principles and the ability to apply cryptographic methods in a space communication context. Proficiency in identifying and exploiting vulnerabilities, and manipulating secure communication protocols, is crucial.

A thorough understanding of satellite communication systems, including CCSDS standards, is necessary. Familiarity with the structure and operation of both ground and space segments will be beneficial.

Skills in Software Defined Radios (SDR) and signal processing, including modulation/demodulation techniques and error correction, is vital. Participants should be adept in using tools such as GnuRadio for signal analysis and signal generation.

Strong programming abilities are essential for tackling different security challenges and being able to perform the different attacks.

The challenge demands strong analytical skills for tasks like analysing Wireshark captures, identifying vulnerabilities, and creating appropriate strategies under time constraints.

Effective teamwork and collaboration skills are crucial for success in this challenge, emphasizing the importance of communication and joint problem-solving.

Event Structure, Qualification and Calendar of Events

The ESA Space Security Challenge consists of an online qualification event and a final, which will be a physical event taking place in parallel to the 2024 3S conference.

To register to the qualifications of the event, the leader of each team is asked to send an email to security4space@esa.int by March the 15th 31st at the latest, including:

The full names of all team members,
Their nationalities
Their student status (e.g. Master student, Bachelor student, etc.)
Their affiliation (University)
A statement that the person agrees with the Rule of engagement.

Teams should consist of 2 to 5 participants (including the team leaders).

More information about the qualification challenges will be provided to the team leaders.

Qualification will take place off-line (i.e. each team will receive and address the challenges separately) between the 16^th to 22^nd 31st of March. The solutions to the challenges will need to be delivered by the team leader before March the ~~22^nd~~ 31st, at 12:00 Central European time. Information about how the solutions will be delivered will be provided to the team leaders.

Teams not yet registered are also encouraged to submit their proposal, provided that they initiate the registration before the deadline.

ESA will publish the list of teams qualified for the final, by ~~March~~ April the 3rd.

The teams which will reach the finals will have access to the flat-sat on site at ESTEC on a rotational basis, ensuring fair and equal opportunity to interact with the actual hardware. This approach not only adds realism to the challenge but also ensures a level playing field for all participants.

The challenges can be downloaded Here.

Required Equipment

For the finals, participants will need to bring their own RF SDR (Software Defined Radio), able to listen and transmit in L-band, as the only interface provided will be a coaxial cable providing them access to RF link in L-Band.

For the finals, participants will also need to bring their own laptops with their own tools pre-installed, so as to be able to prepare and launch their own “attacks” against the target system.

Location and Dates of the Final

The finals of the 2024 3S Space Systems Security Challenge will be hosted at the European Space Agency's European Space Research and Technology Centre (ESTEC), at Noordwijk, in the Netherlands, providing a fitting and inspirational setting for this groundbreaking event.

The finals will take place in the 27th and 28th of May of 2024 in parallel to the main conference.

Eligibility and Registration

Since the main objective of the event is educational, the 2024 3S Space Systems Security Challenge is open to students only (bachelor, master and PhD students).

To participate to the event, teams and _all_ members of the teams shall have to be from an ESA member state or from a state has signed an agreement with ESA on educational programs. For a list of the relevant countries, please check:

https://www.esa.int/Education/Current_ESA_Member_States

ESA Academy Student Team Sponsorship

In the frame of the ESA Academy Conference Student Sponsorship programme, the ESA Education Office is pleased to sponsor the attendance of the 4 pre-select student teams to attend the 2024 Security for Space systems (3S) conference and participate in the final of the challenge. The sponsorship will cover travel and accommodation expenses of min 2 students of each team, up to a ceiling amount of EUR 1000 per team, which will be reimbursed via a single bank transfer after the event and will only be paid upon submission of receipts.

To be eligible for an ESA Academy Student Sponsorship, students must fulfil the following criteria at the time of application:

be part of one of the pre-selected teams of the challenge;
be minimum 18 years old at the time of the conference;
be a citizen of an ESA Member State, Canada, Latvia, Lithuania, Slovakia or Slovenia;
be enrolled as a student (Bsc, Msc, or Ph.D.) in a tertiary education academic programme (not graduating before the conference);
not benefiting from an overlapping financial support to attend this conference, unless duly justified;
agree with the conditions of the ESA Academy’s Privacy Policy

Priority will be given to students who have less than 2 years of professional experience and have never taken part in an activity sponsored by the ESA Education Office.

NOTE: Registration fees for students who will participate at the finals of the Space Systems Security Challenge are waived (there will be no cost).

Rules of engagement – Terms and Conditions

By participating and registering to the event, participants agree with the terms and conditions of the event.

While ESA team organising the event takes all the necessary steps to minimise any unexpected or unpleasant technical problems, malfunctions or damages, participants to the event agree to participate at their own risk and no damage of any kind can be claimed as a result of participating to the challenge.

Participants to the finals are requested not to bring any antennas of any kind.

Participants to the event commit to limit their activities only to the testbed that shall be provided for the challenge. No activities shall take place against other participants, or outside the challenge perimeter. In case any deviation from this rule is detected, all the team shall not only be expelled from the competition, but also from the conference and further access to ESTEC premises won’t be granted.

The event does not include any challenges related with physical, or hardware related attacks (e.g. side channel attacks, etc.). Therefore, participants to the finals are requested not to bring such an equipment.

ESA retains the right to reject or disqualify a team not abiding by the rules without further explanation. ESA also retains the right to update the terms and conditions of the challenge until the beginning of the finals.

Frequently Asked Questions

Do I need any equipment for the qualification round?
For the qualification, no equipment is required, everything will be done online and remotely.

What equipment is necessary and what is allowed to bring on-site for the finals?
For the finals, participants will need to bring their own laptop and RF SDR (Software Defined Radio), able to listen and transmit in L-band, as the only interface provided will be a coaxial cable providing them access to RF link in L-Band.
The SDR shall be capable for full duplex communications without any internal Antenna, such as HackRF (a pair of), BladeRf, USRP, Pluto SRD.
If your device is not on this list, please send us an email.
Participants to the finals are requested not to bring any antennas of any kind.
Bringing specialised hacking hardware on-site (e.g., Rubber Ducky, Pineapple) is not allowed.
No antennas are allowed on site, nor SDR with internal antenna; in case of doubt, please send us your SDR model by email.
Note: we do not provide any equipment to the participants.

What's the process of participating?
Once qualification challenges open, you solve them. Instructions on how to hand in your solutions will be provided together with the challenges. If you get qualified, then you register with ESA to come on-site in May to the final.

Will all the team come to the finals?
Each teams should consist of 2 to 5 participants (including the team leaders). At the finals, minimum 2 team members have to physically participate. It is up to the team if more than 2 (and up to 5, including team leaders) will come. You should be aware though that travelling reimbursement, sponsored by ESA Academy, has a ceiling.

Can I share the solutions to the qualification challenge with others?
Yes, but be aware that if you share it outside of your team before the end of the qualification period, you decrease your chances of being selected for the participation on-site.

How many people will be selected to the final event and how?
We plan to select up to 4 teams to come to ESTEC in May from the candidates that solve the qualification challenge.

Further Information

Further information for the event will be published at this website in due course, and directly by email to the team leaders.