Are satellites a cyberwarfare target?
StoryAugust 07, 2020
Spoiler alert: Yes, they are – as militaries increasingly rely on satellites, especially in the age of guided munitions and hypersonic weapons, it’s becoming critical to protect space assets from cyberattacks.
Satellites rely on connected technologies within the cyber realm, including software, hardware, and digital components, which makes them vulnerable to cyberattacks.
One of the main reasons cyberattacks on satellites are a growing concern is because they’re such a stealthy and low-cost way to inflict devastating damage. As you can imagine, this is problematic for the U.S. Department of Defense (DoD) and all other militaries that increasingly rely on satellites for space imagery and weather maps, communications and positions, intelligence gathering and surveillance, navigation and timing data, not to mention guided munitions.
A NATO report released a year ago, “Cybersecurity of NATO’s Space-based Strategic Assets,”1 by Beyza Unal, put it this way: Almost all modern military engagements rely on space-based assets. During the U.S.-led invasion of Iraq in 2003, 68% of U.S. munitions were guided using space-based means (laser, infrared, and satellite). This percentage was up sharply compared to the first Gulf War, where space-based means were used 10% of the time in 1990 and 1991. Additionally, in 2001, 60% of the weapons used by the U.S. within Afghanistan were precision-guided munitions..
What’s vulnerable?
Three primary segments are at risk when transmitting satellite data: an uplink (space segment), downlink (ground segment), and crosslink (user).
Electronic warfare (EW) methods are known for their ability to knock out communication signals both to and from satellites. But during a cyberattack, it’s possible for hackers to gain full access to satellites and their data; such an intrusion puts the hacker in control and allows them to inflict all kinds of damage.
The most common cyberthreats to the space segment, ground segment, and space-link communication segment, according to the Consultative Committee for Space Data Systems, are data corruption and modification, ground system loss, interception of data, jamming, denial of service, spoofing, replay, software threats, or unauthorized access.
A major part of the problem today is that no one appears to know the full extent of the cyber vulnerabilities of NATO members’ space-based assets and strategic systems. Equally frightening: Any vulnerability within their space infrastructure can potentially spread to other domains.
This situation is especially concerning as the U.S. DoD and other militaries increasingly take advantage of commercial satellites, which aren’t particularly known for emphasizing cybersecurity. At this point, cybersecurity standards don’t really exist for commercial satellites yet; many don’t even bother to use data encryption.
Protecting space assets is becoming increasingly important because EW-based and cyberattacks are on the rise within military operations. And if you don’t know where your vulnerabilities are, it’s pretty difficult to protect against intrusions or attacks.
Hack-a-Sat competition
With all of this as a backdrop – and given the importance of satellites and other space assets to the U.S. military – governmental cybersecurity is starting to attract some much-needed attention and help from the outside the military.
To get people thinking about how vulnerable satellites and space assets are, and to promote education and collaboration within this realm, the U.S. Air Force and the Defense Digital Service (DDS) – which calls itself “a SWAT team of nerds established by the Secretary of Defense to provide the best in modern technology to bolster national defense” – decided to launch a space security challenge: Hack-a-Sat, via DEF CON 28’s Aerospace Village [held virtually August 7-9, 2020 (due to Covid-19)] to showcase their mission. (Figure 1, DDS team with Army colleagues.)
[Figure 1 | U.S. Army Cyber Command soldiers work on a project alongside the Defense Digital Service (DDS) personnel at the DDS workspace in Augusta, Georgia. Photo: U.S. Department of Defense.]
DEF CON’s Aerospace Village is run by a volunteer team of hackers, pilots, and policy advisors from both public and private sectors, with the shared goal of providing the flying public with safe, reliable, and trustworthy air travel. All of these factors depend on secure aviation and space operations. There’s also a focus on cybersecurity education and awareness in arenas ranging from airports and air-traffic control to aircraft and spacecraft.
It’s important to note that Hack-a-Sat is an important evolutionary step forward for the U.S. military – in the past it had attempted to go it alone cybersecurity-wise – and is a great way to encourage security researchers (more colloquially known as hackers) to become more engaged in collaborative aerospace cybersecurity.
Hack-a-Sat is a two-part satellite hacking challenge designed to focus security researchers’ skills and creativity on aerospace system cybersecurity challenges. The event includes an online qualification event (which was held in May 2020) and a final virtual event at DEF CON 28 in August.
“Space is now a critical part of our infrastructure and it needs to be protected. All critical infrastructure is an attractive target and, as space is increasingly used, it’s a safe assumption that adversaries will try to exploit it,” says Pete Cooper, director of DEF CON 28’s Aerospace Village. “All involved stakeholders are working hard to increase its resilience, and we’re doing our bit by bringing the community together to help them build trusted relationships.”
The Aerospace Village is encouraging collaboration and the sharing of the knowledge of all aerospace systems – via workshops, talks, and other activities – to figure out where cybersecurity challenges exist and how to work together to solve them.
During Hack-a-Sat’s final event, participants are challenged to reverse-engineer representative ground-based and on-orbit satellite system components to overcome planted “flags” or software code. The contest may contain realistic spacecraft systems, and teams are encouraged to prepare for challenges associated with communicating with an orbital asset, including scheduling communication passes.
The top three teams to overcome the most flags in the Hack-a-Sat will win prize money – $50,000 for first place, $30,000 for second, and $20,000 for third – for their contributions to the research community.
One of the most surprising aspects of the Hack-a-Sat program for the Air Force so far is simply seeing how much the security research community has rallied around their challenge: “More than 6,000 individuals and more than 2,000 teams registered for the qualification round,” says DeliaRae Jesaitis, strategic communications specialist for the Air Force Research Lab. “We’re excited to see so much enthusiasm and collaboration with experts across the space and cyber domain. Seasoned hackers were scouting experts with a background in astrophysics, and it has brought a completely new dynamic to the traditional capture-the-flag skill set and environment.”
So why did the U.S. Air Force and DDS decide it was time to invite nonmilitary hackers to (ethically) target a satellite? “Security and resiliency in space systems isn’t a concern unique to the U.S. military,” Jesaitis explains. “The world relies on satellite capabilities for global navigation, communication, and electronic transactions, among other things, and so together we need to ensure these systems are resilient against cyber threats.”
Jesaitis views the collaboration at this event as the key to tackling the cybersecurity challenge for the space domain in the future. “By opening this challenge up to the expansive community that understands both cybersecurity and the space domain within a public environment where barriers to the technology are lifted, researchers are enabled to investigate the system’s security posture through the use of nontraditional creative techniques,” she adds.
From all sides
Protecting satellites from hackers is an enormously daunting task – primarily because so many attack surfaces are involved. Attackers can target computer software not only within the satellites and their payloads, but also at their ground stations, communications links, factories where they are designed and built, or even their launch vehicles.
“Satellites pose an assortment of cybersecurity challenges,” says John Marx, senior computer engineer, Air Force Research Lab/RI and liaison to the 16 AF. “A satellite bus is a collection of physical systems running within an entirely remote and resource-constrained environment, equipped with sensors that take in raw data from many external sources.”
Commercial technology is faster than ever on the ground, Marx points out, but satellite hardware tends to lag significantly behind the technology that exists on the ground. “Software updates on a system are risky, but the nature of it being in space makes it much harder to roll back an unsuccessful update, which can put a multimillion or billion-dollar investment at risk,” he says.
Challenges associated with securing the satellite bus, combined with satellites being controlled from ground stations with the same cybersecurity challenges of any other networked system, “makes protection a multifaceted task,” Marx says. “The complexity of these challenges is exactly why it is so important for us to be working with a diverse group of innovators.”
Bridge the knowledge gap
What kinds of things does the U.S. Air Force hope to learn through the competition? “Hack-a-Sat is a joint effort between the U.S. Air Force and DDS to bridge the security knowledge gap between the space and cybersecurity domains to incentivize innovation, so we hope to do that,” Jesaitis says.
The U.S. Air Force wants “to be a force multiplier in bringing together two typically disparate communities so that collectively they can help us tackle the unforeseen security risks within space systems and, ultimately, shape how these systems are designed in the years to come as the space domain continues to proliferate,” Jesaitis explains.
By launching efforts like Hack-a-Sat, the U.S. Air Force and DDS are appealing to the broader security-research community to become allies who are willing to approach the space challenges of tomorrow in an open and collaborative way.
“We want to connect stakeholders across the aerospace domain so that cybersecurity experts and aerospace system engineers are working together to build resilient and secure systems at the onset of the system design,” Jesaitis says. “By enabling this type of collaboration, we intend to learn from the community and change how the DoD and DAF acquire, secure, and integrate our technologies.”
We can expect to see more of these military efforts to collaborate with the hacker community.
