Satellites under threat: discovery of alarming gaps in security

German researchers from the Ruhr University Bochum and the Cispa Helmholtz Center for Information Security conducted an analysis that uncovered vulnerabilities in the software of three satellites currently in orbit. In addition, the lack of some basic means of protection was revealed.

‍

According to the researchers, these satellites contain "basic" vulnerabilities in their firmware, highlighting the lack of progress in space security over the past decade. The problems identified include a lack of protection against unauthorized communication with satellite systems and a complete lack of encryption. The problems identified include a lack of protection against unauthorized communication with satellite systems and a complete lack of encryption, which would allow attackers to seize control of satellites and potentially cause collisions with other space objects.

‍

Satellites are of different types, have different functionality and purpose. Commercial satellites help with Earth imaging and navigation, military satellites are classified and used for terrain surveillance, and research satellites are operated by space agencies and universities.

‍

Impressive Research Findings

Johannes Willbold, a PhD student at Ruhr University Bochum and the lead researcher, characterizes the current state of satellite security as "security by obscurity", indicating the absence of information about their level of protection. While the research group approached numerous satellite operators for software evaluation, most declined or disregarded these requests. The researchers commended the openness of the three organizations that collaborated on the study.

‍

The study centered on three satellites predominantly utilized for research purposes and managed by universities. The verification included the firmware of ESTCube-1, an Estonian cube satellite launched in 2013; the European Space Agency’s OPS-SAT, an open research platform; and Flying Laptop, a mini-satellite developed by Stuttgart University and Airbus.

‍

The research revealed six types of security vulnerabilities, totaling 13 vulnerabilities overall. The "unprotected telecommand interfaces" drew particular concern, as these interfaces, used by ground operators to communicate with satellites in orbit, often lacked access protection, rendering it vulnerable to exploitation.

‍

In addition to software vulnerabilities, the researchers also identified a flaw in a code library shared by several satellites. A stack-based buffer overflow vulnerability was found in software developed by GomSpace, a nanosatellite manufacturer. The issue is caused by a library that was last updated in 2014. GomSpace acknowledged the problem after researchers reported it, but did not provide more information.

‍

Reactions of Responsible Parties to Identified Vulnerabilities

The results of the study led to an active reaction of responsible persons who lead space projects. Simon Plum, head of ESA's Mission Operations Department, acknowledged that OPS-SAT operates under a distinct security paradigm due to its role as a "space laboratory". Plum confirmed that ESA is thoroughly evaluating the study's results and has already initiated changes to enhance satellite security. Similarly, Andris Slavinskis, an associate professor at the University of Tartu, recognized the results as "important and relevant". He contextualized the vulnerabilities found in ESTCube-1, noting that it was designed at a time when satellite security standards were less stringent. Sabine Klinkner, a professor at Stuttgart University, which partly developed the Flying Laptop, attributed the identified "weaknesses" to the delicate balance between functionality and accessibility.

‍

Viasat Attack Underscores Urgency in Satellite Defense

While focusing on research satellites, the analysis highlights broader security issues in the satellite sector. Gregory Falco, an associate professor at Cornell University who specializes in space cybersecurity, says researchers are rarely able to access satellite software, conduct research and publish it. This research is unique and highlights that outdated software, lack of updates and involvement of aerospace engineers rather than software developers contribute to security vulnerabilities in space systems. A prime example is the Viasat cyberattack, which occurred during Russia's full-scale invasion of Ukraine, underscoring the urgency of developing enhanced defenses.

‍

As the stakes continue to rise in the commercial space sector, securing satellites becomes an imperative to safeguard critical functions and data from potential cyberattacks.

‍

_{Author: Nessa, Cyber Journalist}

_{Source:https://www.wired.com/story/satellites-basic-security-flaws/?utm_social-type=owned&utm_medium=social&utm_brand=wired&utm_campaign=wired&mbid=social_linkedin&utm_source=linkedin}

_{Photo: NASA/Unsplash}