Satellite Command Security?

teridon asks: "I work in the satellite control industry, and I've been asked to present mission safety with regards to command security. In other words, how do we ensure that 'unknowns' don't command the satellite. Military and commerical birds often employ encryption on both the uplink and the downlink. However, it seems that none of the science-oriented satellites my company operates do this. We rely on physical security (access to the control center), network security (we use closed networks), technology (most crackers don't have access to a huge radio antenna with which to transmit), and obscurity (each satellite has its own command structure, not publicly documented). Many satellites use CCSDS frames to uplink commands; only the command data is obscured by lack of public info." A common mantra heard from Slashdot is "obscurity is not security", and this is a lesson that teridon wants his company to learn, in addition to other steps they can take to improve the security of their system. What suggestions might you have when it comes to improving security on satellite systems, especially if you have experience from some of the mistakes that you may have seen in production?

"Three major issues concern me (I'm going to assume that our network security works (grin!):

1. Can someone effectively execute a DOS attack by uplinking to the satellite with a powerful signal (the frequency would be easy to 'snoop' from our transmitting antenna), thus preventing us from commanding it? In general, how do receivers handle multiple command carriers (would there be too much noise to command)?
2. How many of you think that you could decipher the structure of the command (given the motivation)?
3. Standards being developed (like SCPS) intend to make satellites 'just another node on the Internet.' Take a look at the security protocol (which is based on IPSEC, et. al) and tell me if you think it is secure, or whether you'd want to crack it.

I'm not looking for the Slashdot population to do my research -- I mostly want opinions on whether cracking a science satellite would be worth the time."

Comments

Given enough motivation

[Tim Ward]

How many of you think that you could decipher the structure of the command (given the motivation)?

Anything can be hacked given enough motivation. That's why different levels of security are applied to different perceived threats - you guess how much motivation the opposition are likely to muster and decide how much to invest in security accordingly.

Re:Given enough motivation

[Cirvam]

yeah but if you accidently send the command that fires the jets and it burns up on reentry then your kinda screwed.

Re:Given enough motivation

[Theodore Logan]

Anything can be hacked given enough motivation.

Why is this such a widespread belief? Has it been proven somehow? Has everything in the world that could possibly be hacked been hacked?

The deduction seems to me the following: everything that has been hacked is hackable => therefore everything is hackable. Where's the logic in that? We don't walk around saying that 10 miles high building cannot be built because we have never built one, do we?

I don't want to come off like a troll, but I'm getting a bit weary of the conclusion that just because noone have proved the existence of an unhackable system no such system can exist.

Re:Given enough motivation

[liquidsin]

it's along the same lines of 'anything that can be made can be unmade'. It's just one of those natural laws...there is no such thing as 'unhackable'. given enough time and resources, anything can be broken.

Re:Given enough motivation

[Havokmon]

It sounds like your perception of 'hackable' is via electronic means.

The jist of security is to deny access to unauthorized personnel. It's WELL known that many companies spend too many resources in one area (Firewalls), and ignore another (fire escape). Plus, a lot of people think you're actually 'teaching' a machine to recognize a person.

If someone wants in, and they can't do it electronically, they'll wander around to the fire escape, and walk into the computer lab. Or use someones 'card' that is authorized.

You wouldn't think cutting a finger off, or ripping out an eyeball is 'hacking', but in both cases, your security is probably breached.

Re:Given enough motivation

[Logika]

It's widespread because the cryptanalytic community seems to consider the fact that anything (useful) that can be done can be undone. Ciphers and codes that can only encrypt but not be decrypted are useless. If a client can decipher it, then someone else can too. The one possible exception to this is if you use quantum encryption since the very act of reading the data stream changes it.

To prevent hacking, you have to eliminate access. This can be done with hardware--best you can do with software is make access incredibly hard. The scenario in "War Games" couldn't happen because even if the US were to configure missiles for automatic launching by computer, the US military would never let that computer be linked to the outside world.

Re:Given enough motivation

[Shanep]

Anything can be hacked given enough motivation.

The key is practicality.

I think this opinion is based on ego. The hackers think they can hack anything, they just "don't have the motivation" to hack the really hard stuff. The system designers feel that they need to believe and portray this because they fear thier systems will some day be hacked or perhaps keep an open mind about it.

I also think it is silly to beleive that an unhackable system cannot be designed.

Although, I agree with the parent poster regarding practicality. I had an MCSE teacher tell the class I was in, that encryption was'nt good because any crypto algorithm could be cracked if the design is known. I wanted to challenge him on the practicalities of it (but I hate always being the arsehole in classes who corrects the teacher). I mean sure, learn the algorithm and brute force the output, but what about the practicality? What if it is an algorithm that is strong enough to realise the full range of a 4096 bit key? How many hundreds of years is it going to take to brute force crack it with the combined effort of all the computers that will ever exist on Earth? Will we (human race) be history by then? Do people in the year 8002 really give a crap about what people in 2002 were trying to hide? Do any humans still live on Earth, having terraformed and populated Mars and some other planets in other galaxies?

Or how about a cipher text done with a One Time Pad, which could be decrypted with loads of different keys to come out as loads of *different* and *incorrect* yet completely inteligible plain texts!

The rest of the class justs nods (duh!). It was the same teacher that told me that to boot an NT server off a SCSI disk, on a system that has NO SCSI BIOS, you just had to load an NT SCSI driver. Yeah, OK teach, good one. MCSE's, poor bastards, are given the inflated belief that they are computer experts once they have passed MS's "computer science". It's almost as pathetic as Scientology.

Re:Given enough motivation

[Anonymous Coward]

I read this differently at first, so came up with a different answer: Because we are continually amazed at what stuff people *do* bother to hack.

Re:Given enough motivation

[keithdowsett]

How many of you think that you could decipher the structure of the command (given the motivation)?

I suspect that the command structure will be fairly simple on most scientific satellites (excepting Hubble) given that there are only a handful of operations which need to be performed. I wouldn't be too surprised if the commands are just a variation of a published scheme in most cases.

The technology to send commands should be within the reach of a decent physics graduate, but I suspect that the price of a suitable transmitter will be the limiting factor for most potential hackers. By the time we're earning enough to pay for a two meter dish and a suitable rack of electronics we've lost interest in hacking satellites.

Just my thoughts,

Keith

Re:Given enough motivation

[Sobrique]

The statemant that anything is hackable comes from the assumption that the system _must_ give access to legitimate users. (Otherwise, it's pointless).
Thus if you assume that at some level it's possible to masquerade as a legitate user, then it must be possible to hack anything.
The 'authentication' method may be really complex and convoluted, making it very hard to masquerade, but until you find some way of uniquely, unforgeably and unduplicatably identifying someone then it's always possible somehow.

Re:Given enough motivation

[gray peter]

And given that security was probably not taken into consideration when creating the command structure it's probably optimized for bandwidth, not for obscurity. If security was taken into consideration it would be fairly easy to make it difficult (if virutally imposible) to crack. Odds are, however, that security was assumed to be inherent, and the command structure was designed in such a way that it would be very easy to decypher.

Re:Given enough motivation

[rridolfo]

Theoretically, the technology to send commands is also within the reach of a decent university physics student. They have nice moveable dishes and transmitting equipment.

Another point to remember is that while /your/ network may be secure, and therefore your uplink gear, not everyone's may be as secure as you'd like. Presumably someone with the motivation and persistence would be able to locate an unsecure uplink that could be used to transmit to a thirdparty satellite. Never assume the only doors (access points) are the ones you put in place.

Re:Given enough motivation

[Tim Ward]

Why is this such a widespread belief?

It is generally believed that if, say, the US government really wanted to hack something and was prepared to expend unlimited resources on the effort it would in due course succeed (if only by doing something as crude as conscripting every publicly-owned computer in the US and doing a distributed brute force attack).

In this particular instance they could, if they really wanted to, design and build and launch another satellite which sat next to the target one and snooped all the traffic in both directions - yer average script kiddie isn't about to do this, so the threat is different.

Anyone who doesn't try that hard doesn't have "enough" motivation and you're safe from them.

It's generally considered that silly children (the type of hacker usually discussed here) don't try that hard, industrial spies try rather harder and enemy governments in wartime try even harder.

You meet the threat accordingly. There's no point in wasting money trying to protect an SME's payroll system against an enemy government, for example.

Re:Given enough motivation

[gehrehmee]

Perfect example:

We rely ... technology (most crackers don't have access to a huge radio antenna with which to transmit)

I don't personally, but one of the many research institutions working through my University has one on a roof of a building on campus. A little wall scaling to bypass a locked door, and I could be playing around with it to my heart's content in a matter of minutes.

Re:Given enough motivation

[Johnny Royale]

I don't think it's logically possible to prove that an unhackable system cannot be built, although I might be mistaken about this. However, as far as what people believe, I do think that believing that anything can be hacked is a preferable assumption for people who design or implement any type of security. Better to err on the side of caution and all that.

Re:Given enough motivation

[Cramer]

And just as in War Games, someone can screw up and leave a modem line unsecured. Of course, Hollywood was very generous in War Games -- access to core .mil hardware is hardly as simple as a phone call.

Now days, everyone logs almost everything, so even if you do get in, they know where to send the black helicoptors.

Re:Given enough motivation

[Cramer]

As any crypto expert will tell you, brute force attacks are the absolute worst way to defeat encryption. It's far easier to steal the key or torture it out of someone. Even Hollywood gets this point right -- go watch Sneakers (ignore the device they're after.)

Re:Given enough motivation

[bmajik]

Because humans make mistakes.

We've all read the article about the psycho software engineering team that does the space shuttle software. They still make a small number of mistakes with each release. On the order of 1 or 2 of them makes it to NASA, iirc, but they're still bugs.

Consider the limited scope of what the shuttle is doing, versus what most network/operating systems do.

Look at the pre-common criteria schemes. There was only one product I saw that received an A1 certification. It was some sort of network encryption device.

iirc, A1 meant provably secure by design, followed by implementation. (again, iirc) No network operating system is listed in that category.

Scheiner (sp) wrote an interesting artcile on encryption and how it relates to security, effectively using the analogy that hoping encryption thwarts attacks is akin to putting a few sharp objects in your front yard and hoping a burglar stumbles into them.. e.g. Typically we can "prove" that an encryption algorithm is impractical to attack, but we already know that most attacks come from implementation defects as opposed to poor designs.

So, I've never heard of an unhackable system.

Software has the very difficult task of making a decision that a human would make, without having all the sensory input and context that a human would have. Finally, it has to be written by (at some point down the line of automation) a human, one who makes mistakes and assumptions.

Re:Given enough motivation

[linzeal]

...and you will serve the same amount of time for torture as you will for hacking anyways, so we need a few ask slashdots about torturing humans on the cheap.

Re:Given enough motivation

[swillden]

Anything can be hacked given enough motivation.

Why is this such a widespread belief?

The problem isn't with the belief, but with the vagueness of the statement. What does "hacked" mean? Depending on the definition of the term, the answer changes.

If the definition of hacking constrains the attacker to using network-based attacks, and if the system under consideration is simple enough, then, yes, it is possible to build an unhackable system (this depends on the nature of the system to a large degree). If the definition is widened to allow physical attacks on technological infrastructure, then the problem becomes vastly harder. If the definition is widened to permit basic social engineering, then the problem gains another dimension that must be addressed. If the definition is widened to include illegal activities like breaking and entering, theft, bribery, extortion, torture and murder, then as long as some user has legitimate access, the system can be hacked.

I'm often frustrated by two equally incorrect viewpoints that I run into on this subject, and not just in the realm of security. The first is that everything is possible. The second is that anything is impossible.

It is not true that everything is possible. The Halting Problem, for example. Finding integers x, y, z and n > 2 such that x^n + y^n = z^n. Copying 10GB of data across a 10Mb ethernet in less than one minute. And so on. Many, many tightly-constrained problems are impossible.

It is also almost never true that any particular task is impossible, assuming all options are on the table. Many things are impractical, and many more things are too complex to get a handle on, but very few real-world personal and business goals are unachievable. If one appears to be, you probably just need a better understanding of the root goals.

When I was a young geek, fresh out of school, I was secure in my knowledge that some things could not be asked of me because they were impossible (and I could prove it!) until I came smack up against a young businessman, fresh out of school who was secure in his knowledge that anything was possible because all the great fortunes had been made by people doing the impossible. Tempers flared, sparks flew and we were both enlightened.

Re:Given enough motivation

[MrResistor]

I think this opinion is based on ego. The hackers think they can hack anything...

I also think it is silly to beleive that an unhackable system cannot be designed.

The problem is, it's even more silly to believe that an unhackable system can be designed. History has proven that time and again. Either argument bears a heavy burden of hubris, but the hackers at least have the bulk of historical evidence on their side.

Practicality quickly becomes a straw-man arguement. New methods are invented daily; computational methods, mathematical analysis methods, etc., any of which could render a seemingly intractable problem trivial. Problems that would take an incredibly long time to solve using traditional computers take only a few days using a bucket of protiens.

To assume it will take 6000 years, or even 60 years, to break a 4096-bit key displays far greater hubris, based on historical evidence, than the hacker who claims there is no unhackable system.

Re:Given enough motivation

[rew]

We don't walk around saying that 10 miles high building cannot be built because we have never built one, do we?

Right. But we can do the math to prove that materials like concrete and steel don't work for that kind of structure.

Proper encryption rules state that the adversary knows everything except your keys. In this case we know that the "command structure" is just a bit complex and non-documented. Nothing to do with having to guess at 128 bit encryption keys.

If you monitor the "normal" traffic to the satelite for a month or so, the command-structure should be pretty clear. Checksums on the packets are also deductable. Then it's easy to send a stream of more or less random commands to the satelite. Chances are it will shoot a couple of random pictures, and then spin off uncontrollably back into the atmosphere.

That would be quite a bummer, don't you think?

My recommendation is to have some simple sort of cryptographic authentication. So the groundstation signs "please do XX at t=YY" with a PGP signature. Think for a second to make replay attacks impossible (*). Problem solved.

Roger.

(*) I just did: have a 32 bit command counter, and have the satelite only accept increasing command counters. Normal procedure is to send them in sequence. If the satelite misses a bunch you have 2 billion commands to try and get it to listen again. Normally you wouldn't get into the "other half of the universe" within say 100 years.

Re:Given enough motivation

[Anonymous Coward]

actually.... most .mil are secured by a simple phone call. it's easier to get in through the phone system than through say, telnet. but the thing is, you have to have to right number appear on their side when you call in. (a sort of caller id.)

Re:Given enough motivation

[RabidChipmunk]

it's along the same lines of 'anything that can be made can be unmade'. It's just one of those natural laws...

It is possible to make a black hole. The ability to "unmake" one is left as a exercise for the student.

Re:Given enough motivation

[42forty-two42]

Here's one:

10 do while inkey$ = ""
20 loop
30 print "You can't hack me, f00l!!!"
40 goto 10

Re:Given enough motivation

[Mr. Slippery]

It is possible to make a black hole. The ability to "unmake" one is left as a exercise for the student.

One need only wait. They unmake themselves. (You just may have to wait a very, very, very long time...)

Re:Given enough motivation

[mpe]

I had an MCSE teacher tell the class I was in, that encryption was'nt good because any crypto algorithm could be cracked if the design is known

A good encryption algorithm is one where knowing the algorithm isn't much help with cryptoanalysis...

I wanted to challenge him on the practicalities of it (but I hate always being the arsehole in classes who corrects the teacher). I mean sure, learn the algorithm and brute force the output, but what about the practicality? What if it is an algorithm that is strong enough to realise the full range of a 4096 bit key? How many hundreds of years is it going to take to brute force crack it with the combined effort of all the computers that will ever exist on Earth?

In which case you don't bother trying to to break the encryption but instead look at other parts of the system or other ways of getting the data you want to obtain.

Re:Given enough motivation

[mpe]

As any crypto expert will tell you, brute force attacks are the absolute worst way to defeat encryption. It's far easier to steal the key or torture it out of someone.

Or for that matter find some way to obtain the cleartext, either before encryption or after decryption.

Re:Given enough motivation

[RabidChipmunk]

Accepted.

However, if we define this degredation as a necessary property of blackholes, then we've another ball of wax.

If a security measure has a built in time limit, do we count waiting until the limit is over?

This does bring up a discussion of entropy, and the relevance of degredation. We usually think of time as increasing the ability of a secret to be discovered because of two things: The agregation of attacks, and improvements in technology. We think in terms of implementing stronger defences. However, over time things break down on their own. If we're dealing with satelites, then there is a lot of radiation, which can flip a lot of bits. More importantly, it's very hard to swap in new parts.

The thing is that this isn't solely an issue with satelites and similar "distant" resources. The tech mindset is based in a replacement mentality; Supplacement is assumed and possibly necessary for the current growth of our abilities. We need to keep everthing on a time scale. How long does this need to survive? How long might it last? What do we do when it fails? What do we do when it doesn't fail? What do we do with the residue (space junk/computer landfills)?

Time is an issue we rarely incorporate in our designs.

Re:Given enough motivation

[mpe]

In this particular instance they could, if they really wanted to, design and build and launch another satellite which sat next to the target one and snooped all the traffic in both directions

You don't need anything so complex or expensive. An aircraft could probably manage to get both sides. Or the combination of a groundstation and a set of satellites in a different (higher) orbit.

Re:Given enough motivation

[MarkusQ]

Here's one:

10 do while inkey$ = ""
20 loop
30 print "You can't hack me, f00l!!!"
40 goto 10

Thus proving the point; I would bet that most actual implementations of this would fall to a "random control character" attack (e.g., ^C, ^Z, etc.).

-- MarkusQ

Re:Given enough motivation

[drrobin_]

Bah, I defy you to hack into this program, when it's connected to inetd with some load balancing and forking limits:

int main(void)
{
int i;
for(i=0; i10; putchar(getchar())!=EOF);
return 0;
}

Care to hack it? Har. Can't be done. Why?

A hack requires an exploitable flaw in a program. The above program does one thing: Reads ten characters from STDIN (stopping at EOF if it shows up early), and puts them on STDOUT. Nothing to exploit. Nada. Zilch.

Sorry to blast the myth, but sometimes slashdot (and its moderators) need a whacking with the clue stick.

Re:Given enough motivation

[drrobin_]

for(i=0; i10; putchar(getchar())!=EOF);

should read

for(i=0; i < 10; putchar(getchar())!=EOF);

Sorry, but I figured that Plain Text mode wouldn't filter out my less than's.

Re:Given enough motivation

[Mr. Slippery]

Time is an issue we rarely incorporate in our designs.

Excellent point. For exmaple, there's growing concern over data stored on "dead media"; enve stuff on readable media can be rendered useless by outdated proprietary file formats.

Some people joked about the Y10k problem a while back, but I think its quite possible that within the next century we'll be building systems with a mission lifetime of thousands of years.

Re:Given enough motivation

[Hast]

Define "Hack". Without that your statement is basically pointless.

If you for instance create a similar program and manage to run it instead of your own program. But it saves the same data to a file as well as echo it, then you have in a sense "hacked" it. (In this case, you have made something which act the same but which has hidden features.)

Granted, this does not explicitly "hack" your program, it hacks the "function" of the program.

Re:Given enough motivation

[GunFodder]

Why would anyone want to hack your toy program? And for that matter the difficulty of unmaking a black hole is probably linked to the fact that a black hole would be extremely difficult to control even by the maker.

There is a direct relationship between the hackability and the usefulness of a program. Take tar for example. I suspect that very few people use it for creating tape archives. But it is still useful because it is flexible enough to suit other purposes. And what is a hack but using stuff for "other" purposes?

Re:Given enough motivation

[drrobin_]

Nobody in their right mind would want to abuse my program, of course. However, I wasn't responding to the black hole comment, I was responding to the "Nothing is unhackable" comment. When nothing you feed a program can possibly cause it trouble, can it be hacked? Nope. Of course, if you're a modern purist you'll use the term "Cracked" instead, but it's the same thing.

Also, I doubt there is a direct relationship between hackability and useability; Rather, H=kU/T where H=hackability, U=useability, T=time spent securing, and k is some constant. I expect that one could, with sufficient effort, make a provably secure yet very usefull program. Such a feat would involve tracing all possible data and that which it affects, and take a crapload of time, but it doesn't mean its impossible.

In my example, the only possible effect the data could have on the program is to have it stop reading new data when it reaches an EOF. The only possible bad data would be past an EOF. There is no possible problem with the program, then. Granted, mine isn't very usefull, but it's just an example to dis-prove a point.

"Everything is hackable", much as it sounds good, and for all practical purposes is truth, just simply doesn't hold up to close scrutiny. Similarities include Newtonian orbits of the planets~ In nearly every situation you could want, Newtonian works great. But on very close inspection, General Relativity starts playing an important role.

If you spend enough time securing a program, it can be provable secure. That this isn't feasible does not mean its not possible.

Re:Given enough motivation

[42forty-two42]

Not if it has no control characters... ;-)

Re:Given enough motivation

[Jennifer E. Elaan]

I suspect that the transmitting/receiving equipment could be built quite easily by somebody with EE training, HAM radio equipment, and a used satellite-TV dish (slightly modified).

Personally, I've wanted to hack the downstream on satellites for a while (passive scanning of satellite communication). It would be fun, free TV, and Hubble pictures right away!

Now, actually taking control of one, that would be too illegal for me.

Re:Given enough motivation

[DerekLyons]

We rely ... technology (most crackers don't have access to a huge radio antenna with which to transmit

I don't personally, but one of the many research institutions working through my University has one on a roof of a building on campus. A little wall scaling to bypass a locked door, and I could be playing around with it to my heart's content in a matter of minutes.

Is that playing with the antenna or the transmitter? One is of little use without the other.

Re:Given enough motivation

[Anonymous Coward]

How about a one-time-pad? Would a science satellite send and/or recieve more than 80G of critical control data (as opposed to science data which is probably going to be released publically anyhow, eventually)? You can't brute-force a genuinely random one-time pad no matter how much CPU power you have, and that's a fact. There's still the problem of keeping the PAD safe however, and DoS attacks (jamming your signal, blowing up your transmitter, EMPing either the ground station or the satellite to destroy the PAD.. are these serious risks?) OK, looking at the 'risks' one by one;

DoS - What's the cost of equipment to do this? (very high) How high is the risk of being detected? (also very high) and are there any gains to be made that would offset this risk? (perhaps notoriety, but most people consider DoS attacks to be very lame)

Taking control; the cost is also high but there's at least 'bragging rights' if not an actual financial gain to be made. I'd suggest encryption, and keep moore's law in mind when choosing the key length too; your 'adequate' key today is going to be much too short in five years time if the satellite is still up there.

Umm.. I really don't know, actually. About the only thing I can say for sure is there's no way in hell I'd be asking slashdot if I really wanted serious answers. And I'm posting anonymous because this is all just bullshit too :)

Re:Given enough motivation

[Anonymous Coward]

I belive youre either very dumb or reads everything without thinking twice.

Everything made by man is hackable by man or higher creatures. Thats logical, becouse man equals man. One man had motivation to create something to stop other man to access other man has the same or even higher motivation to crack the other man 'stop other man to access' and of course he will success unless the crack man is lesser than the create man.

No go figure.

P.S. I hope this explanation was enough neanderthal for you.

Re:Given enough motivation

[Anonymous Coward]

If anything here is neanderthal, it's your spelling.

Re:Given enough motivation

[Anonymous Coward]

Quantum computers would theoretically allow the decryption of anything but a one time pad or some message encrypted using a quantum method, in constant time. Personally, I think it's quite likely we'll see such working systems within the next two decades. But, otherwise, you're right, your teacher is an ass.

Re:Given enough motivation

[liquidsin]

If you spend enough time securing a program, it can be provable secure. That this isn't feasible does not mean its not possible.

Indeed, and by disproving my theory that everything is "hackable", you've "hacked" my theory, thus proving it. Wrap your head around THAT!

Seriously, I wouldn't normally want to make such a broad statement as "all things are hackable" (I use "hack" and not "crack", since I'm not just talking about damaging systems here...) but for the sake of this discussion, it's as near to truth as you can get. When you start working with things like a satellite system, you've got too much software / hardware to juggle. You're right: it's simply not feasible to test every single snippet of code. Add to that the possibility that someone on your team will sell you out for cash (social engineering can be a hack too, I suppose...) and there will always be a way in on a project of this size. It just needs to be found. Maybe nobody will ever hack your little program, but what about inetd? Or the machine hosting it? Or break into the building housing the server and take a hammer to it? A satellite is much more important than what you wrote (no insult intended ;) and some people would do whatever it took to get at it. When it's security to that magnitude, all avenues must be considered. And somewhere on one of those roads, there's a door.

Re:Given enough motivation

[GunFodder]

Your formula (H=kU/T) seems good, and also shows that hackability is directly proportional to usability, which was my point if not my semantics.

I agree that "Everything is hackable" is not true, but the spirit of this statement is important and valid. How about "Everything useful is hackable"?

Re:Given enough motivation

[Andy Dodd]

Not in this case... As you'd have to be NORAD to figure out with enough detail what the results of a given command are.

Re:Given enough motivation

[jo42]

Wot if there was a buffer overflow somewhere in the underlying implementation of the library and/or OS?

Re:Given enough motivation

[shepd]

An unhackable system cannot be designed simply because (to be useful to us) at some point the system must be controlled by us.

If the hackers can't hack the equipment, they will simply socially engineer themselves into a position to use it.

The only unhackable system is one contained entirely in 10 ft. thick of diamond. But then, how could it be used?

There's the dilemma. As long as there's a human involved, you can't win. That human can be tricked, and then no matter how much security you have you are screwed.

For example, a OTP is crackable if you can convince one of two the parties that you are on their side.

In a related story:

[GigsVT]

I forgot to lock the vault at the bank I manage, and no one is there right now!

Limited time offer!

Re:In a related story:

[Anonymous Coward]

Already stopped by. Thanks a bundle; now I can finally afford that Mac I've been wanting.

Re:In a related story:

[GigsVT]

Offtopic, what the hell are you thinking crackhead moderator?

My post is very on-topic, and relevant to the topic in discussion. Maybe if you had half a brain you could figure out what an analogy is.

Re:In a related story:

[Anonymous Coward]

>Maybe if you had half a brain you could figure out what an analogy is.

Naaah. Moderators think they're Goderators by virtue of having 5 out of 10e4 mod points on any particular day and being able to flip a bit that changes one word on a page on their browser. To them, that's real power since they don't have any in meatspace.

I loved the way that Cliff phrassed that

[Bandman]

Did the
"...this is a lesson that teridon wants his company to learn."
sound like a veiled threat to anyone else? :)

Maybe it's the pre-caffeine stage.

Re:I loved the way that Cliff phrassed that

[Tha_Zanthrax]

I really wonder really if this guy works for the company he says he works for. My guess is they just fired him...

Re:I loved the way that Cliff phrassed that

[teridon]

I have not been fired. (i.e. I'm not looking to destroy some satellites!) :-P

I actually submitted this article to Ask Slashdot months ago. I had assumed it had been rejected, and didn't care enough to follow up. But good ol' Cliff came through.

Re:I loved the way that Cliff phrassed that

[Tha_Zanthrax]

You could mod this -1 "Offtopic", cuz it is.

I got a +1 "insightfull" moderation for that post. I was aiming for +1 "funny"...
Funny, I actually submitted this article to Ask Slashdot months ago. First time I got a submittion accepted I had already forgotten it. It took about 2 weeks and my first guess when I saw it was that someone had stolen my idea. The second time it was on in about 2 days.

Protect the satellites

[Anonymous Coward]

You've better protect all satellites with high grade crypto.

Otherwise the aliens will be able to use the satellite network to coordinate their attack on the Earth.

Re:Protect the satellites

[Anonymous Coward]

Really? Then why was their computer so easy to attack with a virus?

Re:Protect the satellites

[Anonymous Coward]

what the hell are you talking about?

Re:Protect the satellites

[TheGreenLantern]

No, it was clearly the stunning power of the Mac Powerbook and Jeff Goldblum's incredible intelligence that made this possible.

Re:Protect the satellites

[Anonymous Coward]

Obviously because the aliens were using MacOS.

Re:Protect the satellites

[Anonymous Coward]

"Hey, this is Unix! I know this!"

(Ooooops, mocking the wrong movie. Yes, I know, wrong character too. geeks, sheesh!)

Re:Protect the satellites

[MrMrBen]

Once again, the aliens underestimated human determination and ingenuity: "grit". It's a good thing that out of all the intelligent life forms in the Universe, only human beings have this gift.

I assume the run of the mill reply to this is...

[cscx]

"Make publicly available all the source code and documentation of the satellite's protocols. Then the entire Open Source community can have any and all bugs fixed in under 2 hours. Also, by making it Open Source, bugs in the code that would make it vulnerable to cracking can be found more quickly, and thus sealed up. The idea that all your protocols should be classified and confidential is ludicrous. Just look at Microsoft, they close their stuff up and look at all the holes in their software! You must release everything to the public."

I'm sorry...

[Anonymous Coward]

but if you don't know the answers yourself, or can't find the answer from some other source than slashdot readers, we're all in big trouble.

here's an idea...

[turbine216]

...this might sound obvious to some, but maybe if you need to ask this type of question, you shouldn't be in charge of securing a satellite...

Just a thought.

Re:here's an idea...

[Amarok.Org]

That's probably a bit harsh. You're probably right, but...

He didn't say that he had no idea where to start, nor did he say that this was his only source of information on the issue.

Having done security work in the past, I'd often solicit the advice of other security experts (ok, so maybe Slashdot isn't the place to ask) to see what directions they'd go.

If I prefaced my questions with what *I* thought was important or the Right Way (tm), that could color the thought processes of my resource(s). By keeping my ideas to myself (at least early in the process), I could get their objective opinion, perhaps with ideas that I'd not previously considered.

Just my $.05 (inflation, you know).

- Dave

Re:here's an idea...

[Anonymous Coward]

also if you know how the security of your satellite control works, then maybe you shouldn't describe how someone would breach your security. security through obscurity works if the people who know dont go telling everyone else the secrets.

Re:here's an idea...

[Anonymous Coward]

If you don't have something nice to say, then maybe don't say it. :) The poor guy's just doing some research, and a poll is a part of that.

Re:here's an idea...

[ruvreve]

I don't think by asking this question he should be deemed unworthy of securing satellites, instead you should consider it going the extra mile by asking several million? nerds how they would approach the situation. Now if he relied on /. as his primary tool for the succesful completion of his job related duties then I think I want his job.

Re:here's an idea...

[Anonymous Coward]

You should not be so quick to judge. I mean how many satellite security experts do you know? It seems obvious to me that he was saddled with a project outside his area of expertise, and most likely outside of his company's expertise. Since this does not seem to be a #1 priority to the company, it is reasonable that he is taking on the project, and reasonable for him to look for help, and ok for him to ask opinions. Im sure we have all been stuck on some project at some point, and needed to get some outside input.

Re:here's an idea...

[Anonymous Coward]

> ...this might sound obvious to some, but maybe
> if you need to ask this type of question, you
> shouldn't be in charge of securing a
> satellite...

I'll take it one step further. If you are this
persons manager, and you hired this person, be
expecting a reprimand from your superiors
eminently...

Re:here's an idea...

[lucifuge31337]

The biggest problem I have with this is that he asks whay multiple transmiters hitting the receiver of the satellite will do. No only is that obvious to those who know the RF design of that particular satellite, but it also follows that their engineers already know this information. The question is being asked in the the wrong place.

Re:here's an idea...

[Anonymous Coward]

Maybe he's not trying to solicit the opinions of security experts, but just a few script kiddies. There are a bunch of trolls at slashdot ya know.

Re:here's an idea...

[Anonymous Coward]

Just because he's trying to hijack other brains to come up with ideas, doesn't mean he's in over his head. It just means he knows he's not omniscient. There's nothing wrong with lack-of-arrogance.

Re:here's an idea...

[synaptic]

He's trying to build job security. Post an article to Slashdot asking how to secure a satellite and conveniently mention that most satellites have no security.

Most readers are interested but never think about it again. A few actively seek out further information and work towards compromising the satellites. And they eventually do.

Now this guy is in demand.

It's just like the anti-virus folks hiring someone to write a virus.. hell, probably Phalcon/Skism.. and the products begin to sell themselves. Or the security consulting firms whose employees release exploits to increase the demand for their services (among other reason).

Re:here's an idea...

[DerekLyons]

I don't think by asking this question he should be deemed unworthy of securing satellites, instead you should consider it going the extra mile by asking several million? nerds how they would approach the situation.

How is this 'going the extra mile'. The response so far indicate that even the fraction of /. users that have responded are largely clueless about the issues involved. Being a nerd does not mean omnicompetence, nor even the possesion of an informed opinion.

May have military use...

[maroberts]

..especially if the hacked science satellite had enough manoevering fuel to be used to crash into a GPS or military satellite.

Satellites are getting larger: if the satellite was sufficiently large to enable large lumps to reenter and you could predict reentry then you could attempt to use it as a missile, but this is obviously a very hit and miss affair.

In the light of September 11I don't think you should assume that civilian targets (or civilian satellites) will be left alone by a terrorist.

Re:May have military use...

[brocheck]

The feasibility of retasking a hijacked satelitte onto a collision course with a target is small, but in the right circumstances possible. Keep in mind that the satellites have a very limited maeneverability and retasking in itself is very rare. Fuel is also very limited (which is why retasking is such a loathed task in the satellite industry, it costs hundreds of thousands of dollars.) It might be possible to create a new orbit where the sat 'runs into' another. But considering GPS and mil sats, there are tons of redundancy in these systems.

The availability of the large R/F transmitters would also be a large hurdle (it would not be possible to make an FM/AM radio station into the ranges). However, I'm just kinda startled that various security methods (encryption, basically) wasn't designed into the satellites. Satellites are HUGE investments. It boggles the mind how much they cost to produce and send into space. Kind quirky to leave it to closed protocols alone to protect such an investment.

Conclusion: highly unlikely, but possible.

Re:May have military use...

[con]

What makes you think that only terroists would be interested ?

Is it not possible that rogue nations, spy agencies, or e-war ministries would see that accessing and taking control of one of these to either cause an "accident" by hitting other satellites or by being aimed at a relatively populated area would cause enough damage to scare people/governments as the current situation with jumbos ?

Do any/many science satellites use nuclear material ?
If they do then it may not even matter whether any material makes it intact into the environment, it may actually be an "advantage" to have it burn up and get blown around in the wind over a continent rather than trying to aim for a specific city.

Re:May have military use...

[Snow_crash_69]

Umm...the idea of taking one satellite and crashing it into another is like taking a rock and throwing it at another rock moving 17,000 mph. I would find the fact that they would just crash it so it is unusable or try and bring it down in a populous neighborhood more likely than trying to use it as a missile to take out military satellites.

Re:May have military use...

[Anonymous Coward]

Aren't GPS satellites in much higher or
different orbits than most commercial
satellites? If so I would think that
it would be awkward if not impossible
to make that kind of orbital change.
DoD has been think about ASAT technology
before the 80's one of the easiest of which is
a kinetic ramming of a asat satellite into
the target.(although there was that F15 asat
missle)

Re:May have military use...

[Merlin42]

I think mostly this is because computational resources are _VERY_ limited on a satelite. Most sats use a space hardened 8086 or similar. Only the huge projects get any computational power (eg iirc hubble has a 486). And of course better CPUs or specialized encryption hardware would eat precious power. I have not personally worked on a satelite, but have sat in the back of a couple of design reviews for a satelite and seen people fight over tiny fractions of a watt.

Re:May have military use...

[Tom7]

Yes, and don't forge the playing field is many times larger than the surface of the earth. It would make a good spy story or action movie, but I don't think it's very reasonable in practice. (Also, remember how much trouble it was to bring down mir in the right area? It would also be non-trivial to bring one of these down in a city...)

Re:May have military use...

[Logika]

Another problem with using the captured satellite as a weapon against another satellite is that the hijacker would need to know where the target(s) is/are PRECISELY. These puppies are moving at a minimum of 7.5 kps -- that's DAMN fast. Miscalculate where they are by just a split-second and you miss your target by kilometers.

Maneuvering in orbit also takes time as well as fuel -- I think the US military would notice something like this and take protective action for the potential targets. Remember that NASA has maneuvered the space shuttle to avoid space junk, what, a dozen times now?

Re:May have military use...

[Anonymous Coward]

It is extremely difficult to hit a satellite with another object even if you have all the resources of a large space-faring nation. Doing it as a terrorist organization would be next to impossible.

A few points:
Where do you get your precision orbit information from? The only real source is the US government, and it's pretty closely held, particularly if you need it in a timely manner. (I'm talking SP data here, not GP) The timeliness is the big issue. If you don't have the data withing a rev of your planned impact, odds are definitely not in your favor. Additionally, the software needed to use this data is not publically availble either.

You will have no closed loop terminal guidance of your "missile", so good luck with the end game. Even SP covariances are on the order of tens to hundreds of meters in size, so without onboard sensors and terminal guidance, its just a crapshoot.

Even if the bird you hijack has sufficient fuel to make the required burn (very unlikely), such a large orbit change would not go unnoticed by USAF. It would almost certainly take several revs at best to make the attack (more likely several days), giving adequate time to take evasive action.

As for reentry, you'd be doing pretty well to hit something the size of Texas reliably. I've worked in the field.

Re:May have military use...

[Anonymous Coward]

GPS is in a much different orbit then most other stuff.

Most satellites are either in LEO, GEO or Molnya orbits.

Re:May have military use...

[Anonymous Coward]

Hey guys,
Lets remember the US Air Force has a fighter launched anti-satellite missile that has been tested and in service for almost a decade. What does it take about 15 minutes, for the US Space Command to identify a target, get authorization, contact an active duty base and scramble an F-15. Add some extra time if the missile isn't pre-loaded (which something tells me they are). Especially now in our heightened state of security, I'm not sure how long it takes for a satellite to be moved onto an intercept course but something tells me we would have a good chance at taking it down if need be.

Re:May have military use...

[Anonymous Coward]

Uhm, you're talking completely out of your ass. F15 ASAT was never really operational, and hasn't been for more then a decade.

Re:May have military use...

[geekoid]

but this is obviously a very hit and miss affair.
Not really. I you know all the pertenant nu,mnber, its actually not that difficult to be reasonable accurate.
ICBM are not aimed at the ground, there aimed at a point in the sky, then they fall to the ground. Same principle.

Re:May have military use...

[Anonymous Coward]

Except, ballistic missiles have well known ballistic coefficients, shapes, etc. And they are launched on a much lower, slower suborbital trajectory. Which means that their reentry is much more predictable then that of a satellite.

This is even more true due to the very limited dV available, which means that you will likely have to rely on atmospheric drag to accomplish the final deorbit. In practice, you'll be lucky to pick which rev it comes in on.

Re:May have military use...

[Cramer]

And the shuttle(s) have been hit by space junk numerous times. It worries NASA to see bits of "dust" going 2/3's the way through a window. They funded research at several universities (NCSU was one) to improve their tracking capabilities.

The point is, moving a commercial sat would certainly get attention -- tracked or not. The people using that bird are going to notice it not answering or transmitting data back. And a sat-sat collision is extremely unlikely -- space is "really big". It's not like we have junk parked in space like a freeway at rush hour.

Re:May have military use...

[Cramer]

You need to be a hell of a lot more than "resonablly accurate". Unlike missiles, it doesn't have a precision guidance system to take it to it's target. There's too much delay from the ground station to make very many corrections once they start getting close. This all assumes there is enough fuel to change orbits.

ICBMs have autonomous guidance systems to ensure they reach the intended target with zero assistance (from people who may be dead already.)

Re:May have military use...

[pdqlamb]

I think one reason so many satellites have so little computing power is the length of time it takes to build and launch one. Remember, these are all custom electronics; so you take the best chip available, and build around that. Five years to design, build, and launch a bird is fairly reasonable. (Space qualification and integration into the launch vehicles can easily take a year of that!) Then they may stay up there for another 5-15 years.

Keep in mind that most commercial processors might last a week or two, so you have to qualify or harden what you put up there. IIRC, there are hardening programs now for the PowerPC chips (650 and 670s) and a Pentium; seems Intel doesn't want to sell its intellectual property until its wrung what it can out of the commercial market.

I've heard Iridium was powered by 68000s, probably because of the hardening lag. If the Hubble has a 486, it was almost certainly an upgrade! Hubble's launch schedule was delayed because of the Challenger explosion. Fifteen years ago, I wanted a 80286 and had heard Intel might release a new 80386 in another year or two. So it probably went into orbit with something like a Z80.

Re:May have military use...

[tyresias]

Actually, Iridium uses hardened PowerPC, which a lot of modern space hardware uses.

Re:May have military use...

[Anonymous Coward]

>And a sat-sat collision is extremely unlikely --
>space is "really big". It's not like we have junk
>parked in space like a freeway at rush hour.

It's already happened at least once.
The french Ceres satellite had its GG boom lopped off by a Ariane rocket body back in '96

Re:May have military use...

[MrResistor]

What is the computational power for? If it's for mechanical systems control than even a Z80 is probably 10x the computer you need. "Fire attitude control jet 3 for 2 seconds" requires a miniscule amount of computational power.

In 2000 I was working for a company that made high-end digital video equipment, and I was shocked to discover that the system I was working on only had Pentium-2's (233MHz, IIRC), but then I realized that all the CPU was doing was presenting the UI and all the real work was being done with specialised hardware (like the realtime MPEG encoders that cost $13k each). If the UI wasn't writen to run on top of Windows NT they probably could have gotten away with a Pentium, or maybe even a 486.

Now I design automated manufacturing systems and even a 486 would be ludicrously powerful for our applications. A simple ladder-logic PLC works fine, and even a mechanical engineer can program and debug a system in under a week.

My point is, for systems control CPU power is largely irrelevant. In a well designed system the work is offloaded to specialised hardware that can do the job much more efficiently, and the CPU just sits there saying "hey you, do this". The only reason I can think of for Hubble to have a 486 is for address space to buffer images.

Re:May have military use...

[Anonymous Coward]

well your kind of both right. I'm an AF junkie. If you believe the reports the ASAT program is on the books as of the 2000 fiscal budget for both equipment and training. The rumor is they are "training just a few pilots in this area if the need should arise". Take it or leave it. Oddly it popped up on the 1993 budget as well. Officially it was phased out sometime shortly after the initial tests in 1985 at which it was successful but with some very limiting fators. . Just some food for thought

Re:May have military use...

[Anonymous Coward]

Perhaps there are greater dangers than crashing satellites... attacking satellites? On my bookshelf there's a compilation of SF stories, chosen by Jerry Pournelle, named "There will be war". One of the stories is a paper on THOR, an orbital weapon system, by Weapons Committee Citizens' Advisory Council on National Space Policy. It featured military advisors, scientists, and... SF authors. The paper on THOR describes how low-cost satellites can be built for specific military use. The purpose would have been to launch thousands of them and to create a net around the globe. If the USA would then have need for the hitting power of one of their fleets, they would have it in a satellite. The principle was that a satellite could reach position within 10 minutes, then fire 10 missiles of 3 feet long, metal cilinder of one, maybe two inches wide. It would bear a small explosion charge in its nose, as well as an infra-red guidance system. The rest of the satellite would mainly be protection for the weapon, possible with lasers to defend against other satellites. Very interesting weapon though, but if it exists, it would be a frightening one too. If terrorists get access to such device, the USA's gonna have a hard time.

Re:May have military use...

[plsander]

The RF facilities are not that hard to build.

There are amateur radio operators who have built the antenna systems and transmission equipment to do satellite control. They were using it to bounce their signals off the moon and back to earth.

These systems are expensive, but not out of reach of hobbyists. They are not what I would call stealthy though.

Search google for "EME" or "Moonbounce"...

Re:May have military use...

[ReelOddeeo]

How likely it is that you can crash a sat into a target (ground or other sat) is irrelevant. I agree. You probably can't bring down a sat onto a specific target, such as the MS campus.

What I haven't seen posted here yet is what the human reaction would be in the population. Imagine the terror this would cause. Everyone would be afraid of a sat comming down on their head. Can you see daytime talk shows telling people not to go outside, and other such nonsense.

Just look at what the reaction to anthrax was. That was not even militarily significant and look at the fallout. Just like Iraq's scud missles during the 1991 gulf war. Militarily insignificant, but terrorize the population, and expend significant time/effort talking about it.

Re:May have military use...

[thewiz]

FYI:
MOST military satellites (at least the IMPORTANT ones) are in geosynchronous orbit (about 20K miles up). Most commercial satellites are below 2000 miles and definitely do NOT have the fuel to reach geosynchronous orbit.

What would be worse is using one commercial satellite to kill another commercial satellite (say, a communiations satellite).

Of course, you're assuming that the hacker in question will have control of the satellite long enough to do such a thing. All the control center would have to do is pull the plug on the antenna the hacker is using (if it is owned by the company that owns the satellite) and switch to a backup. The time it takes for a satellite to change orbit makes an attempt to do so easy to detect.

Re:May have military use...

[gd23ka]

I'd say it's the other way around... most commercial sattelites are in geosynchronous orbits and most military sattelites are in non-geosynchronous orbits and some of these military sats have a lot of fuel for switching orbits, but who gives a fsck, this is slashdot and I don't work in that field.

Oh and as far as pulling the plug on somebody else's antenna is concerned... a couple of years ago someone jammed a couple of transponders on a chinese tv bird. Took them a couple of months to find that transmitter.

My two cents about unsecured sats.. Even if it can't be used as a weapon in of itself, one could at least deplete it's fuel tanks rendering it soon useless.

Re:May have military use...

[DerekLyons]

I think one reason so many satellites have so little computing power is the length of time it takes to build and launch one.

Another reason is that they don't *need* that much power. A satellite isn't running Quake 2. It's often hard for many to grasp, but substantial tasks can often be easily accomplished with a specialized OS, minimal processor power, and proper programming. (The Strategic Missile Fire Control System used in a Trident Submarine has roughly the computing and I/O power of an 8086 PC.)

Re:May have military use...

[DerekLyons]

ICBM are not aimed at the ground, there aimed at a point in the sky, then they fall to the ground. Same principle.

No. They are aimed at a point in on the ground, then given enough velocity to reach that point.

That being said, it's unlikely that a satellite could be used as a weapon to threaten a ground target. Most (99%) satellites won't survive re-entry, and it requires tremendous accuracy in timing and the reentry burn to hit a specific target.

Re:May have military use...

[Andy Dodd]

5 years is not the case in many satellites... It depends on what the satellite's missin is.

The original submitter of the article indicated scientific satellites... Some science satellites are 10-cm cubes that are designed in a year by part-time work and have a budget of $30k total.

See www.cubesat.org

In this case, the processor is still limited because of the power issue - I'm becoming involved in a CubeSat project at school (Designing the communications hardware), and they're using a standard embedded system board.

Re:May have military use...

[Andy Dodd]

Exactly... But for a LEO sat with its comm systems in the GHz range, the system could be pretty stealthy... And hard to RDF, if the antenna was designed properly (little to no energy going anywhere but up)

The equipment needed for EME (I know a guy with an antenna half the size of his house and it's not enough) is far more than what would be needed for screwing around with a LEO sat.

Experts

[Anonymous Coward]

Oohh boy, here's an article that's just begging for "expert" slashdot advice.

"While I've never actually worked on a satellite system, I did hack encryption into my walkie-talkies when I was 8..."

Just what would you do with it?

[ravenswood1000]

For the most part, what would you do with a satellite you just took over? Save on long distance?

Re:Just what would you do with it?

[mclinc]

Crash it into something and watch it burn!

(This isn't a real question right?)

Re:Just what would you do with it?

[Fembot]

erm go onto irc and say "d00d3 i just ownd3d that satalite"?????????????

EEP! The sky is falling!

[rmadmin]

I don't like the idea of some big freaking satellite bombing down on my apartment, so heres my input.

I like the idea of encryption. It will turn away most of the little script kiddies, but then again so does obscurity for the most part.

most crackers don't have access to a huge radio antenna with which to transmit

Never Underestimate!!! I don't know much about RF communications with satellites, or how powerfull it has to be or whatnot, but I'm pretty sure if someone was determined enough, they could hack something togather. Or if they work at a radio station in a small town that goes off air at night. *shrugs* who knows.

Obscurity is a great thing in some cases, but I don't think it comes anywhere close to actuall good security. Then add confidentiality to it, and awesome physical security, and your in the right direction.
Just my small view on it.

Re:EEP! The sky is falling!

[Anonymous Coward]

most crackers don't have access to a huge radio antenna with which to transmit

Perhaps easier to try to subvert the transmitter at "mission control" rather than try to control the satellite directly? That reduces the problem to one of (earthbound) network security, and IMHO, increases the threat.

Re:EEP! The sky is falling!

[Twylite]

In my (limited) experience with crackers, the ones that are actually breaking protocols (rather than running scripts) tend to be older and with good resources ... typically high school or undergrad.

In either of these positions (but esp. undergrad in elec.eng or similar) such folk are likely to have access (or be able to access without too much trouble) school of university facilities. Certainly most of the universities here have some fairly powerful transmitters available.

Anyone listening in on the command streams and watching intently enough will be able to piece together the protocol in time ... by experimenting they risk damaging things but can speed up the process.

Re:EEP! The sky is falling!

[Anonymous Coward]

Or if they work at a radio station in a small town that goes off air at night.

This was marked as informative?!? You people need to get a clue.

Re:EEP! The sky is falling!

[lucifuge31337]

Never Underestimate!!! I don't know much about RF communications with satellites, or how powerfull it has to be or whatnot, but I'm pretty sure if someone was determined enough, they could hack something togather. Or if they work at a radio station in a small town that goes off air at night. *shrugs* who knows.

The only thing you're proven here is that you certianly do not.

That post was far from informative. Aparrantly someone who know less about this that you has mod points.

Re:EEP! The sky is falling!

[Anonymous Coward]

Ok, encrytion is a good idea. Really it is. The problem with encryption and science birds, are that the satellites are often engineered to fit a very tight envelope (energy and processor usage is key). Simply put, there may not be enough room in the satellite design paramaters to implement 3DES.

Also, most science satellite are pretty small. They'd burn up upon re-entry. The real threat for earth orbiting satellites (which it would be more likely to stuff some sort of encryption into) could crash into military or commercial satellite assets. Personally, I'd choose the MTV satellite (MTV sucks anymore).

The long range probes aren't a threat in themselves. Certianly, it would be disappointing to have a 100Million$ plus project fail. But to have it seccumb to a terrestrial skript kiddie would be a shame. The resources required to do it, however, are humoungous.

So, maybe nothing needs to be changed..

Re:EEP! The sky is falling!

[Anonymous Coward]

Does not work that way. Almost all sites are Receive ONLY. Secondly, the band used to control Sat. is usually not the same as its data band.

I see the basic concern - however, to gain control, you would have to overwhelm the orginial signal. Most birds are controlled from 10 meter (or larger) dishs with hundreds of watts of power. My bet is that it would take a government (or similar size entity) to actually do this. Secondly, the operator would know that his bird is getting hit - and would be on the phone to NRO/NSA in moments (insert other agency for your country). Finding the transmitting site is pretty simple too - it would have to be in area of the little dish on the bird.

Now, hijacking a transponder (or channel for SCPC)? That would be easy. But you would get caught. Too much sniffing going on for the NSA not to notice.

Re:EEP! The sky is falling!

[Cramer]

and how many of those dishes are easily re-aimed? I've not seen very many aimable dishes around. There are tons of fixed position dishes (including the really big one at Microspace -- ala Musak.) However, those things are rather difficult to move.

Re:EEP! The sky is falling!

[Phork]

working at a radio station wouldnt do to much good, an antenna meant for 100mhz wont be to effective at 3ghz(i think most satelites use uplinks in this range), an antenna meant for 1mhz would be even less efective. satelite communications are done with incredibly directional antennas(uasualy dishes), most fm broadcast stations use omnidirectional antennas, and even the ones that do use directional antennas arent directional enough, and they arent pointed up, they are pointed toward there target audiance, which is on the ground. Most people who work at a radio station would proabyl also have a hard time comming up with the the 3ghz transmitter that they would need.

Re:erm

[GigsVT]

After the apocalypse, the only thing left will be satellites and spam.

Re:It depends ...

[Anonymous Coward]

Sorry, no. You'd need optics much closer and more powerful, as in an electron microscope.

A couple of ideas

[Neorej]

Obscurity doesn't work. Internet seems to know everything, or know someone who does, it's strange but true.

Where I work we rely on a couple of things for security and they seem to work pretty well, I've been working here for nearly 5 years and I can't remember we ever got cracked.

1. SSH
2. Identity keys and passphrases along with 1.
3. IP filtering, you have to be on an IP in our network before you can reach any critical servers.

If you couple this with a private network I don't see any real threats to the network, unless some kid builds a nuclear powered high frequency mega super radio antenna thingy in his backyard to send the whole thing crashing down to Tora Bora.

Re:A couple of ideas

[Anonymous Coward]

Obscurity doesn't work?

Yeah, right. Tell all the Osamas of the world about how to crash the satellite on the White House.

That's exactly the kind of slack attitude towards security that led into our nuclear secrets leaking to China (thank you, Mr. Clinton!) and September 11th.

Re:A couple of ideas

[Neorej]

I'm not saying you should just go out and sell all your satellite information to the highest bidder -although that might make enough money to balance the budget- I'm just saying you should never rely *solely* on obscurity.

Re:A couple of ideas

[nomadic]

Obscurity doesn't work.

It doesn't? Maybe it does work, but you just don't know about it.

The first step in shutting down a satellite via hacking is to submit a story on slashdot pointing out the security holes, thus planting the idea in a lot of peoples' heads. And no, the script kiddies aren't the only ones who do this sort of stuff. As much as people don't want to hear it, there are plenty of morally bankrupt but tech-savvy people who know what they're doing, and have the mentality of teenage vandals.

Re:A couple of ideas

[Anonymous Coward]

As much as people don't want to hear it, there are plenty of morally bankrupt but tech-savvy people

What's so "morally bankrupt" about finding flaws in a product and showing it to all of the world? After all, that's the way the bugs get fixed.

Every time Microsoft attempts to keep a lid on the information about the bugs in their OS so that they could prepare a patch for it, the entire /. cries out how wrong that is. In the same sense, keeping the satellites out of the reach of hackers (who could point out the bugs) is wrong, isn't it?

Re:A couple of ideas

[nomadic]

I was referring to the people who would hack into the satellites just to be destructive, not the guy who pointed out the security flaws.

Re:A couple of ideas

[lucifuge31337]

Yeah...all the engineers working for Russia's space program can't figure out exactly where a space station will land when it's brought back to earth, but some hacker will figure out how to hit a building with a satellite they've hacked.
That's pretty likely. Good point.

Re:A couple of ideas

[Anonymous Coward]

Ohhhh, Clinton bashing! How 90's.
(Mind you, I'm not defending Billy boy here... I think both Pepsi and Coke are equally craven and corrupt. Just the way our system's set up &ltinsert grandpa Simpson quote here&gt)
Didja ever notice that whenever there's a Bush in the Oval office, we're at war with the Arabs?

Security through obscurity only works if...

[Anonymous Coward]

... you do indeed have obscurity. Just telling the world that your system are hackeable in such fashion may be enough to spur enterprising crackers to go out, to look for more data and come up with something. You even provided some leads yourself, from where some enterprising young minds can work: park a van with a suitable receiver near your ground station (related to SOHO?) and start snooping the frequencies used, then the data, etc.

Questions about your own company's security are better not asked in public, especially if you suspect said security to be lacking...

Although in general real security is preferable over the appearance of security, the appearance of security can still serve the useful purpose of making would-be crackers believe that they'd be losing their time trying. Admitting security weaknesses in public will have the effect of getting a whole bunch of folks interested and motivated...

Slashdot it !!

[Tha_Zanthrax]

What if we just slashdotted the hell out of one those satellites. Just to show the that decent scurity isn't luxury.

Go with the new standard, worth hacking

[f00zbll]

If you want to know if hackers will find it interesting, the answer is yes. I grew up around hackers and crackers and both would be interested for several reasons. The biggest one is because they can and they have time. I know plenty of teenagers who know 4+ languages including assembly and know more at 13 than I did at 22. I'm not embarrased to admit it, since these kids are smart. Some are misguided, but most stop at 18. I have first hand experience with friends who hacked and got caught by the FBI and crackers are determined to get in.

Just to give you an idea, some crackers during the BB era in southern california were stealing credit cards to buy commercial software, then sold cracked versions to the largest BB in southern CA. They were eventually caught and the FBI took away all the computers. All of them were under-aged, so they didn't do any time. All of them were interested in science, so they would definitely be interested in what your satellite is sending. More interesting is getting control of your satellite.

Also, remember that crackers tend to have parents who have technical careers, but no time to watch their kids. Hackers and crackers have a lot of time, brains and energy to burn. With all the articles recently about amatuer and college programs building their own satellites, it will become a bigger concern. As kids get more technically advanced at a younger age, more systems will get compromised. It's a fact of life.

Re:Go with the new standard, worth hacking

[Anonymous Coward]

Although these kids are so really very smart (debatable that is, because they often do very stupid things), they are missing one key thing.

Thy don't have a freakin dish that can receive a milliwatt, or transmit the wattage and frequencies that are required to even attempt to do this. A big government may have the resources to build such a thing, big corps, etc.

Basically, it all boils down to this:

My dish is bigger than yours!

Re:Go with the new standard, worth hacking

[dattaway]

They don't have the power to transmit? Oh boy, used microwave components from the magnetron in the microwave to surplus TWT tubes are mighty easy to get. Any pre-teen can transmit a few kilowatts throughout the microwave spectrum with a high voltage transformer, a capacitor, and a tube. Bonus points for modulating it with a simple amplifier.

Hard to do? This stuff is laying around, everywhere. It just takes some imagination, wires to hook it up, and an afternoon of fun.

Re:Go with the new standard, worth hacking

[dghcasp]

Just to give you an idea, some crackers during the BB era in southern california were stealing credit cards to buy commercial software, then sold cracked versions to the largest BB in southern CA.

And what did a Bed & Breakfast need with all that cracked software? Perhaps they were trying to attract more geeks and offered special "theme" rooms where all the doilies and stuffed animals were replaced with CD-ROM's and stuffed penguins.

Moral: Define your abbreviations.

Re:Go with the new standard, worth hacking

[f00zbll]

I didn't think geeks get out enough to go to bed and breakfast. I guess I deserved that one for not saying bulletin boards. But then again those who actually know that stuff wouldn't bother asking. :P

Nice Starband Hack

[codepunk]

Yea nobody has a big antenna that can transmit a signal to satellite. Just how big of a attenna do you think you need. The one in my yard is not that big and with a little hacking probably would do the job nicely. Hell you reading this message means that I can already transmit a signal to a bird. Only obscurity for the command protocol, you must be kidding. Bo ha ha ha ha

Re:Nice Starband Hack

[Anonymous Coward]

I read that commercial uplink-stations for tv are available for about 2000$ at the right sources.
Ok, to be fair, those TV-Sats are often big and have big ears too so you can use a 1m dish to uplink. But i guess many commercial or science birds are equipped with those big ears eh, dishes too :) All you need is a travelling wave tube, the xmitter itself and a horn which blasts the waves into you uplink dish. Dont forget the proper digital equipment you need, thats the only thing not commonly available on the market i suppose .. so long.

Re:Nice Starband Hack

[k9nl]

Being a ham I know there are a lot of people out there who know a little bit about satellites (There are also a lot of people who know a lot about satellites, make a satellite, name it AO-40, and when it gets up it doesn't work, but thats beside the point) There are enough people around who have some understanding of the radio side of things.

Now as for someone radio-DOSing you I don't want to say more than I know but I do know of an important property of FM called like selection effect or something. In certain (or most, like I said I don't want to speak beyond my knowledge) cases a significantly stronger signal is selected over a weaker one and the weaker one isn't heard (I should remember more details but I'm a little sleep deprived today).

The question is how are you modulating this? The selection effect might not be as present in AFSK I DON'T KNOW. Are you doing some pulse-mod thing, FSK, or whatever (I assume this is digital, not like DTMF thing where you can just tape the tones and replay them, can you say air raid siren control)? That should influence the DOS possibilities. Anyway there will always be the noise issue, I guess I'm talking more about the DOSer overpowering you.

As for obscurity, people will still try to get in. Obscurity just makes it more of a challenge. By the way I'm not a cracker.

PKI

[Hard_Code]

The simplest system for ensuring that two entities are talking to each other, without a complex system involving third parties, seems to me to be PKI. Just embed a private key in hardware on the satellite (or perhaps several) and then use PKI as normal. This key never leaves the satellite so the risk of being "hacked" is equivalent to cracking PKI. This of course could be strengthened (or weakened??) by coupling with precise data only known through obscure methods involving lots of precise scientific hardware, e.g. stuff the crackers won't have.

Re:PKI

[Eimi Metamorphoumai]

"If you think cryptography can solve your problem, then you don't understand your problem and you don't understand cryptography." -- Bruce Schneier

And that goes much stronger for PKI. Do you even know what Public Key Infrastructure means? In this case, just get a good, solid shared secret key. There's no reason for asymetric keys.

Re:PKI

[jmaslak]

I do PKI for a living. Actually, in this case, it might not be the right choice.

Do you really mean PKI or simply Public Key Encryption? Do you actually picture a root certificate authority, subordinate certificate authorities, directories, certificate revocation lists, and authority revocation lists being used to secure a satellite's command & control?

PKI is a great choice when you have lots of parties that need to randomly communicate with each other. It provides a great key distribution. However, PKI seems like overkill when one (or, at most, two) ground stations will be talking to a satelite. In this case, distributing a shared secret really isn't that difficult - probably much easier then building a PKI network and keeping it secure! Of course it does depend on if you trust your internal computer systems to keep the key private. If you don't, then PKI might solve some of your problems.

I would suggest a very lightweight approach. Privacy of data is not required for this application, IMHO. Maybe I'm wrong, in which case, you should investigate other options. This sounds like a good case for a MAC (Message Authentication Code). You don't even need to use encryption - just hashing - to do this.

Basically, each end has a shared secret, "S".

You have a packet containing data, "D".

Each packet has a timestamp (to prevent replay attacks) "T".

All packets consist of: D+T+MD5(D+T+S)
Of course, you can use some sort of hash besides MD5. You can also program the satelite with a few thousand secrets, which expire every so often - if you give it 100 years of secrets at launch, you should be fine.

The satelite receives this packet, does the MD5 of D+T+S, and compares the numbers. It doesn't let you use a packet with an old T (T should be very close to the current time and T should be greater then the most recent T).

This code has the benefit of taking very little memory space compared to a PKI solution. It's also much easier on the uplink/downlink channels.

The most important thing to remember, though, is that this shared secret has to be kept secret. It should not be used by your normal programmers to write control software. Instead, it should be an external module that runs on a secure box (I.E. no remote administration capabilities, only allows connections via a secure interface, and adds on the MAC as the messages pass through it). If you can afford a satellite, you can afford one secure server! I would definately investigate commercial encryption devices which add on a MAC using a shared secret - at least on the ground-station end. They of course may function differently then the method I described above, but the basics remain the same.

Of course all of this has been solved before. ATMs and banks have long needed to authenticate the other end. (ATMs, BTW, do not use public key cryptography, but simply a split key pair - that is, a random string of numbers is one part of the pair and that string XORed with the real key is the other pair - each part is given to a different person who keys it into the ATM seperately from the other person - you might also incorporate this type of system). Since this has been solved before, I recommend that you hire some sort of encryption expert to help you (you are NOT looking for a computer security person - chances are you are not running a default install of W2K on your satellite!).

As for IP, I would think that you would want to ensure there was no way for someone outside the control room to use your equipment to send command and control messages to your satellites! At the very least, this means that the control room should probably have an air-gap between it and the rest of your network. Sure, a little inconvienient, but how much command and control data do you really have to share with people outside that room? Not much most likely - certainly not too much to retype.

Re:PKI

[Anonymous Coward]

When designing the system, you need to know that satellite builders usually keep their design as simple and stateless as possible.
Nobody would like to end up in the situation that the real-time clock on the satellite flips an unknown bit and no valid commands can be sent anymore.
Usually, the satellite has no realtime clock (or at least not one that isn't reset by a master reset command), and the designers always want to have available a command that resets everything to a state where they can always send commands they know will be OK.
Also, they like a system where succesfull sending and execution of a command does not require the link to be operational in two directions.
(i.e. no session key exchanges, no challenge/response systems, no dependance on things like a realtime counter the command station first needs to receive and then use, within a certain time interval, to compose valid uplink commands)

Security Engineering

[FullClip]

I would recommend you to read the book Security Engineering by Ross Anderson.
It gives you a perspective of security from a lot of different fields.
If you must secure stuff you have to think like an alien.
If people who were supposed to control the Defense satellites
in Britain had thought like an alien, none of their satellites
would have been hijacked,
but that story seems to be untrue :).
Anyway, secure your babies.

Forget reverse engineering -- who's quit lately?

[pointym5]

Definitely assume that anybody you really don't want knowing your command structures will know them. Do you keep the documentation (or source code) in a locked vault with genuine security (not just "don't tell anybody where the vault is")? Do you have strong entry/exit security (can you take an 8mm tape home with nobody noticing)? Are your internal machines firewalled completely from the public Internet? Most importantly, how much do you trust the people who know how it works? Are you sure none of them wouldn't sell information for a few tens of thousands of dollars (or sex)?

Complete security

[ThePurpleBuffalo]

Complete security is impossible. If someone wants access, they will eventually get it.

The most secure authentication scheme I've seen in a while is talked about in great detail here:
http://www.rsasecurity.com/products/securid/hard wa re_token.html

The idea is that if you need a physical token, and some knowledge to authenticate, you have added another level of security. These tokens are (from my understanding) REALLY hard to reverse engineer. They generate a number (that looks random, but isn't) every minute. On the other side of the connection, the same pseudo-random number is generated. If they match at authentication time, you get access, if they don't, try again.

The other thing you were wondering about was DOS attacks. Go read this article on GRC:
http://grc.com/dos/intro.htm
It boils down to this: if it's distributed there is little you can do.

On the flip side, since these signals would require massive antenae, you can triangulate the source in a matter of seconds, and send some guys (cops, navy, army, etc) over to shut them down.

Either way it goes, this is an interesting problem. Keep us posted with the results.

Beware TPB

Re:Complete security

[radish]

My understanding is that this "problem" is primarily for communications between trusted computers - i.e. base station to bird, and making sure that neither (particularly the base station) could be impersonated. In this case SecureID isn't really appropriate - it's great for dialin (most big companies use it for this) and for authenticating _people_, but I don't imagine you want each controller to have to authenticate him/herself directly with the bird. There are plenty of hardware based heavy encryptionk devices around, I think IBM make some. Basically a custom chip and some eeprom encased in polymer, along with some tamper-detection sensors. Encrypt the whole stream (or just the commands themselves) with a shared-secret key algorithm (don't bother with public key) and bung one of these hardware units at each end. Voila ;-) Easily better security than the ATM networks, and no-one has (publicly) cracked those yet.

Oh and tale EVERYTHING you read at grc.com with a pinch of salt. Or better yet don't read anything at grc.com. Still, he is right when he says that anything internet based is liable to DOS, it's the way routing works. Until someone comes up with a clever way to fix it..

Re:Complete security

[lucifuge31337]

On the flip side, since these signals would require massive antenae, you can triangulate the source in a matter of seconds, and send some guys (cops, navy, army, etc) over to shut them down.

Sorry. Try again. It can be done with an antenna small enough to hide in an attic....no more than 4 feet long or so, depending on what frequency you are uplinking. And it would (have to be) highly directional, so there would be little to no chance of triangulating it from ground stations.
And it can be done with $5000 or less worth of radio equipment, and run off of a few car batteries.

Re:Complete security

[Phil Wherry]

The SecurID tokens work pretty well; they represent a nice balance of security and ease of use for the inexperienced user. The server software is a hulking piece of difficult-to-manage bloatware (it was when I last used it two years ago, in any case), but it's generally being installed and used by experienced folks.

The cards themselves have some tamperproofing that protects them from casual disassembly, but it doesn't look like something that's designed to withstand a determined attack. I think it'd be much harder, though, to access the internals of the card in a way that wouldn't leave obvious visible evidence of tampering--I'm guessing this was the design goal, not total tamperproofing.

The algorithm used by the cards isn't something that RSA publishes, but it's been out in the open for a while now.

The cards are each preloaded with a secret key, which is also loaded onto the SecurID server that does the authentication. Without the secret key, the algorithm doesn't do you that much good so long as it isn't easily possible to derive the secret key from a sequence of the displayed number. The jury is still out as to whether this is possible. But assuming there aren't obvious holes in the algorithm, one has to obtain the keying material from the server (where it's presumably closely guarded) or from the physical token itself. Doing the latter would require theft of the token or tampering in a way that would be obvious to the user.

Re:Complete security

[Niggle]

Hardware based solutions may not be appropriate for use on a satellite.

Aside from the obvious size/weight/power considerations, you have some reliability concerns that you don't get on much Earth-based equipment:

It's got to survive launch.
It might have to stand high radiation levels.
You can't replace it if it fails.

Time based keys may present their own problems if there is a potentially long time between sending and receiving data. You'd need to be able to calculate what the key would be when the command arrives. Relativistic time dilation effects might also be an issue at some point in the future, but they aren't likely to be a problem over the expected lifespan of any satellite we build today.

Re:Complete security

[pclminion]

On the flip side, since these signals would require massive antenae, you can triangulate the source in a matter of seconds, and send some guys (cops, navy, army, etc) over to shut them down.

Actually it wouldn't be quite so simple. A directional antenna doesn't spill much, and a good directional antenna hardly spills at all. Remember, the radio beam is directed into space, not overland. Triangulation is used for locating omnidirectional point sources, not small-angle beams.

I suppose they might be able to work with the signal reflected from the ionosphere, but it would be very weak, phase shifted out of recognition, polarized out of recognition, etc. It certainly wouldn't be easy, and perhaps impossible.

Re:Complete security

[geekoid]

Complete security is impossible.
Not so, I have seen completely secure military installations.
I don't care what you see on TV, Nobody without authorization can get in.
and no, you can get authorization without an extensive check that includes checking figureprints and a face to face with the security officer, and a photo taken AT that time to use as reference each time you want authorization.
Also theres the fact that if you don't ID yourself befor entering no man zone(a long white hallway)they'll shoot you. but that last part ,might be difficult to do with a non-military control center.
so its not Complete security is impossible
its "Complete security thats convienant is impossible"

Re:Complete security

[Anonymous Coward]

Satellite uplink antennas are highly directinal, so triangulation would not work. OTOH, if someone hacked your network long enough, they could simply use your facilities :)

The only major reason this won't happen soon is perhaps the cost of such a setup. Setting up the antenna and transmission equipment would run at least several tens of thousands.

Re:Complete security

[JWhitlock]

Not so, I have seen completely secure military installations. I don't care what you see on TV, Nobody without authorization can get in. and no, you can get authorization without an extensive check that includes checking figureprints and a face to face with the security officer, and a photo taken AT that time to use as reference each time you want authorization. Also theres the fact that if you don't ID yourself befor entering no man zone(a long white hallway)they'll shoot you. but that last part ,might be difficult to do with a non-military control center.

Just out of curiosity, what security checks do the janitors go through? Repair personnel? What if there is a fire? Are there security-cleared firemen?

Re:Complete security

[yther]

Just out of curiosity, what security checks do the janitors go through? Repair personnel? What if there is a fire? Are there security-cleared firemen?

I can answer, from personal experience with less secure facilities. Totally secure facilities like the one described would not have janitors; cleaning and such would be done by the military personnel. Likewise, repairs would be conducted by the same people already there for routine maintenance -- military personnel stationed there.

Further, if security is extreme, they'd also have on-site emergency personnel; otherwise, the watch would decide (or be ordered) to allow outside personnel in, based on written emergency procedures. Such procedures are in place for all military facilities, covering everything from minor fires to disaster evacuations.

Re:Complete security

[DerekLyons]

Just out of curiosity, what security checks do the janitors go through? Repair personnel? What if there is a fire? Are there security-cleared firemen?

*Everyone* who works in a secure (military) facility goes through the same security checks. And yes, there are sometimes security-cleared firemen.

Re:Complete security

[Rupert]

That is not complete security. All an attacker would need is one more disposable person than you have bullets.

Also remember that the most prominent spies in recent US history have had very high levels of security clearance. You might be able to stop spies coming in, but you can't stop the people already on the inside becoming spies.

Security or authentication?

[DaveHowe]

Not sure what the requirements here are - but it seems you are more concerned with correctly authenticating a command to the satellite than concealing the content of the commands.

If that is the case, then you really only need to change the format slightly to include timestamped (or sequentially numbered), signed messages rather than unauthenticated ones (timestamps to prevent simple retransmission of commands as a "cut and paste" control system). There are plenty of PK signature solutions out there - but I assume uploading a new program may be a problem - debugging would be a nightmare ;)

Signatures?

[Waffle Iron]

I'm assuming you're worried about satellites already in orbit. If their software can be modified by upload, how about at least adding a routine to check a digital signature appended to each command packet. That could help prevent some script kiddie with a hacked DSS dish from rooting your spacecraft.

As for new satellites under design, just encrypt the channel, stupid! Its not like its rocket science or anything.

the very fact that you told us how you already...

[synchrostart]

...secure your satellite systems is a huge security breach. You just told us you don't use encryption and that to attempt communication you need a radio antenna. Some people do have access to radio antennas. Heck they aren't that hard to build yourself anyhow, there are specific books and internet articles on them. Pick up most books on HAM radio antennas and they atleast mention it. So given some time and effort could someone exploit your satelittes and crash them into another one?

issue 1

[nusuth]

yes, they can prevent you from commanding the sat iff they can track and transmit to it from somewhere near your base. I'm not aware of any non-directed sat antennas, but then again I'm not an expert either.

In general case any single channel signal can be drowned with another signal at the same freq. and with a comparable power.

Sat Security

[Mr. Buckaroo]

General comments:
This type of question is probably best not asked here.

I highly suspect you are whom you say:
1) Why ask questions about such a sensative issue here in such a loose and public forum
2) If your company does indeed control multiple satellites, why do you not have answers to such simple questions as # 1? I would expect you would contact one of your own engineers.
3) This list could go on for quite a while.

I appologize if I'm wrong about the above, but I tend to suspect this is a dupe post by someone either interested in hacking a network or interested in getting people together to hack sat's.

Questions:
1) This would depend to some degree on the com hardware on the bird. Signal jamming is a quite known property of emf communications.

2) Yes. People have deciphered far harder things than a ordered (probably) control protocol.

3) I didn't look at the protocol yet. Yes, folks will want to hack it though. Sat's are l337 d00d.

Re:Sat Security

[Anonymous Coward]

Sometimes you need to expose problems in public to get visibility to get changes made.

That said, a big transmitter implies lots of RF energy around at least near the antenna. Picking up the commands should be simple, decoding them not so hard either...at least for some commands.

Best way to avoid having this happen is to have some authenticators on commands, both ways, that use a secret, and change the secret periodically since humans are not always secure. Don't presume nobody can transmit to the bird. Someone trying to take it over will not after all likely care much about FCC limits on side noise, RFI, TVI, power use, etc., and a cruddy wider array of antennas
phased properly can mimic a larger aperture one.
If it lights up every receiver that is sensitive
to the band in the county for 5 minutes, that might not matter, just so it moves away before anyone can direction find the signal. This sort of thing isn't a 5 minute job, but what would the cost be if someone did take over the bird? Can it be used to blackmail anyone? Would a terrorist be able to use the threat OR action of stealing the bird? Also, are there any "halt and catch fire" modes in the bird that might be tickled by suitable messages? A disgruntled ex employee might
know of such if they exist. They might not be in the manuals either.

I can't think of anything better than crypto auth here, maybe with a known correct key exchange algorithm if you want not to have to prestore all the keys (there are a few such...search the literature).

The correct answers are:

[Anonymous Coward]

1.Can someone effectively execute a DOS attack by
uplinking to the satellite with a powerful signal
(the frequency would be easy to 'snoop' from our
transmitting antenna), thus preventing us from
commanding it? In general, how do receivers handle
multiple command carriers (would there be too much
noise to command)?

No need to execute DOS attacks, an overpowering RF
signal would do the trick.

If the story is still around, and (iirc) look for
the story of UOSAT-18, how it was given up for
'dead', and how a ;-) strange blast of ? power
restored it

2.How many of you think that you could decipher
the structure of the command (given the
motivation)?

See # 1. Taking it out and gaining control are
two different things and (imo) gaining control is
useless.

3.Standards being developed (like SCPS) intend to
make satellites 'just another node on the
Internet.' Take a look at the security protocol
(which is based on IPSEC, et. al) and tell me if
you think it is secure, or whether you'd want to
crack it.

See # 1 and read up on "Project ALOHA"

Addendum:

Going above the RF problem, you might consider L.
Brett Glass's paper on bipolar quadrature
amplitude modulation (using a constellation
pattern) and using a form of FEC that gets the
header/etc. decoded locally.

Re:The correct answers are:

[Anonymous Coward]

Good troll. Combining information that is for the most part good/correct with bogus references. Too bad you posted anonymously. Zero credit.

Re:The correct answers are:

[Anonymous Coward]

So many big words, so little time.

dos

[bluelip]

Hopefully the DOS attack you mention would be quickly thwarted. (If your satellite was worthy of gov't help that is) If the attacker was using extra power to block your signal, you could track the signal to it's transmitting atenna. This shouldn't take too long to find.

Re:dos

[Anonymous Coward]

Yeah, I believe that they'd "help" it by pointing a big laser at it. Not a problem for very long.

Re:dos

[Anonymous Coward]

DOS!?! After all these years and they still use DOS?! No wonder why they got the attacks they deserve.

Remember HBO?

[millwood]

Many years ago HBO's satellite was overtaken for a few hours by someone in the "northwest quadrant" of the continental US. My electronics teacher at the time told me that most satellites would lock into the strongest signal being transmitted to them, and that most control centers used the least amount of power to get a lock-in. So apparently this guy just used a stronger signal than they were using.

As for hacking the command set? You better believe it. Get four engineers and a large blackboard and you might be amazed at how useless "security through obscurity" really is.

Re:Remember HBO?

[RobNich]

I believe you are referring to Captain Midnight. I found the story through google, but the site (textfiles.fisher.hu) is down.

Captain Midnight was an employee of a satelite uplink station. He was angry about the impending scrambling of HBO's satelite signals (he was a satelite dish dealer as well). He aimed a transmitter at HBO's satelite and transmitted a total of 2 or 3 seconds. One or two weeks later he did the same thing, this time with text on the transmitted screen instead of only a test pattern. He identified himself as Captain Midnight and expressed his anger (I forget what he had typed).

In the story (written by the man himself) that I read online a year or so ago, he mentions that the reason it took over was that it was a stronger signal than HBO's ground station.

----

On topic, as far as determining the command set, don't forget that everybody can monitor the communication to/from the satelite. A few thoughts, though:
- Is the frequency set in stone? Frequency hopping, split spectrum, etc. Is there a government body that may keep the frequency or range on file, such as the FCC?
- If using encryption, I would recommend an open standard, so that all the bugs have been hammered out.
- Rotate keys and use a large set of keys to make it more difficult to crack.
- Always fill data packets with white 'noise' so that all data packets are the same or random sizes. This make it more difficult to crack, since they never know what is real data and what is junk.

These are standard techniques of course, so I'm sure that teridon has thought of them. But I find this subject quite interesting and want to show how much I know.

On top of all of the above, physical security is indispensable. You might even come up with creative ways to keep each technician from holding all keys, and require multiple techs to do a certain task, since each provides a set of critical data or algorithms. These are also (I assume) standard practice for at least military-grade operations.

Re:Remember HBO?

[flollywebfrog]

A similar form of satellite sabotage occurred to the Kurdish Television station Med-TV in 1995. This press release from the London-based Kurdish station which broadcast to all of Europe, the Middle East, and North Africa on Eutelsat describes how a live program was taken off of the air by a second, more powerful uplink. It states:

the second carrier responsible for the jamming was spotted after MED-TV's own transmission carrier was intentionally dropped to identify the origin of the pirate interception. Secam colour bars, implying deliberate jamming, were momentarily seen, but an identification of origin could not be made. MED-TV's satellite service providers suspect sabotage, and official sources say the cost to jam MED-TV's signal would be approximately a quarter of a million pounds, as it requires the use of high calibre technology. MED-TV's engineers believe that, given its nature, the intercepting signal was transmitted from a European country.

Clearly, which ever group was responsible for the jamming of the Med-TV broadcasts (it occurred regularly during the existence of the station) had the equipment, scientists, electricity, and monetary resources to exploit the weak satellite security. While I am unsure of the culprit was ever identified, most news reports assumed that the Turkish government was the likely suspect. Dr. Amir Hassanpour writes in A Stateless Nation's Quest for Sovereignty in the Sky that giving the timing and other evidence, Turkey's motivation for sabotage was political. The 2002 World Press Freedom review also identifies Turkey as the high-tech criminal where it writes:"Med TV's news and panel discussion programmes have been targeted by jamming signals emanating from Turkey, while in Kurdish regions of Turkey, satellite dishes and antennae have been prohibited and destroyed by soldiers and police units."

I suppose the point I am trying to make clear is that hacking of satellites will likely occur for political motivated reasons, as opposed to curiosity or to fill a cracker's boredom. The consequences if caught and prosecuted are severe, and success requires satisfying a complicated, dynamically changing equation of location, resources, knowledge, and timing.

My standard reply

[nochops]

We should we tell you?

Isn't that why you get that *fat* satellite commander paycheck? I'm sure someone here could tell you, but really, if you're not competent to do your job, why should you have it?

These "I dunno how to do my job so I'll ask Slashdot" posts are getting really tired.

I'm tired of people making loads more money than me, when they really don't know squat about what they're doing.

Seroiusly, why should your company pay you to do a job if you don't know how to do it? Why don't they just fire your ass and "Ask Slashdot" themselves?

Re:My standard reply

[Anonymous Coward]

Yeah, that's right.

A classical Linux zealot's advice: why should we help you, read the fucking manual.

Elitist twit.

Re:My standard reply

[Anonymous Coward]

Why should we fucking help him? He's not going to open his source code at the end, so he can take a flying fuck at a rolling doughnut.

Yours is a typical closed-source cocksucker's answer: "I don't understand Linux, so I think everyone involved in it does everything for free."

Ignorant jackass.

Re:My standard reply

[nochops]

Funny thing is, I'm not a Linux zealot by any means. I know very little about linux. BTW, if there is a manual to read on satellite security practices, I'd like to know where to find it.

I'm just saying: Why was it that the poster was selected to be the 'satellite commander' at his company? What is it that he has that the other candidates did not have? Evidently knowledge about security practices is not one of the requirements. Where do I apply?

Do yourself a favor and check out the satellite listings on monster.com and see how much those guys are pulling down per year. Then tell yourself that they shouldn't have to know what they're doing.

So if your into the whole open source open knowledge bullshit that telling him how to do his job would entail, then it just naturally follows that he should *NOT* be getting a paycheck, right? His salary should be distributed among those who gave him information, right? If that's the case, then yeah, *I'll* RTFM and get back to you on how to hack a satellite. You just get my check in the mail.

My Guess on why or what to do ?

[da5idnetlimit.com]

Think easy :

1 - Because I can.
Coolness Factor +10 8)

2 - Because I"ll have access to a HUGE bandwith (FXP is the term here) (Coolness +8)

3 - Because I can (Ditto 8)

4 - Fucking Race horse too boring, let's go Space Opera !!!

5 - C'aus if I take the right one, I will have access to ALL the Phone Network...(nice, Coolness +4)

6 - Caus I can hunt the ISS AND see the track the progression record on CNN Live 8)

7 - Caus the insurance company that just rejected my file IS responsible for the Sat...

8 - I WILL save on Long distance caus I have 16 000 phone lines available

9 - Caus I can

10 - If the only thing you ask is "Ok I have the Sat, no what" please go to the parlor and get a Perrier. Sparkling water Might be a little too much for your overexerted mind...

11 - (last idea) Caus I can have a 801.11 Network that is large as half the USA.

Requirements we had on small science satellite

[braddock]

Military and commerical birds often employ encryption on both the uplink and the downlink. However, it seems that none of the science-oriented satellites my company operates do this.

Wow, really? (imaging how many /.er are ebay bidding on dishes right now....)

As an undergraduate I worked on a small student-built scientific satellite, and even though the satellite barely had any need of an uplink, I seem to recall we still required strong command authentication, and that we also required the ability to be able to turn off the satellite transmitter and receiver in certain regions of the world, and that these requirements came straight from the DoD. My understanding is that we had to be prepared to respond to certain possible DoD advisories. In fact we probably would have done away with the uplink except for them.

The trasmitter turn-off requirement was apparently so that rogue states could not use the bird for navigation purposes or possible sensing.

Now the advising engineers on this project came from a lab (JHU APL) that does a TON of military birds, so it's very possible they were just imposing good practice on us. Maybe someone in the know could tell us more.

--Braddock Gaskill

Re:Requirements we had on small science satellite

[Anonymous Coward]

Wow, really? (imaging how many /.er are ebay bidding on dishes right now....)

Really!?
You've seen 6 meter C-band dishes on EBay lately?

Don't be naive...

[david_e_v]

Do you really think that, in case there was any ultra-secure system, this information would be posted in /.?
Security through obscurity is not an option, but this doesn't mean that you have to publish in capital letters all your security measures. That would be simply silly (no flaming).

Troll satalite!

[Anonymous Coward]

Giving goatses
Penis birds
First posts
and more to every one

Oh Great....

[mlknowle]

You have just unvielded a great new target for all the script kiddies out there...

"Hey man, lets go hack a satalight and use it to spy on GIRLS!"

"What, do you think I can access it with my 802.11 Airport?"

"We could crash it into the Whithouse like in that movie!"

Re:Oh Great....

[eric434]

"What, do you think I can access it with my 802.11 Airport?"

Well.... 802.11b *does* operate on the 2.4Ghz spectrum, awfully close to the ~2.05Ghz frequencies used by satellites. All you need is a monstrous amp and some hacking around with the frequency-reference (probably a crystal, who knows) and you could possibly use the transmitter on the Airport's internal card. Of course, you'd have to remove the 802.11b bits, since AFAIK satellites *DON'T* take 802.11b frames as commands :)
You might even get it to work, provided you're living in a cheap Hollywood hacker movie.

Of course, it would be more effort than its worth. Just do a black-bag job on the nearest university's E.E. department or comn center... Much cheaper than the amp you'd need to bump the Airport's output from 30mW to 100W+ :D

Obscurity works very well if...

[five dollar troll]

...you avoid extending "challenges" like this to the hacker world. Obscurity is only effective when it is TOTAL obscurity. It doesn't work for Microsoft because everyone already knows that they will (after X number of attempts) find some type of hole in their software. For situations like this, however, there is no interest in targeting the satellite, because there is little or no knowledge of its existence. Therefore, it's not a challenge, and won't be considered such by hackers-at-large.

But now that the cat's out of the bag...look out...

Zap 'em a virus...

[karot]

I saw Independence Day - I know just how easily "they" can upload a virus to an orbital device :-)

Re:Zap 'em a virus...

[Anonymous CowboyNeal]

But that's Jeff Goldblum. He's not real -- he's a super-human Mac user. Just look at the iPod commercial -- no white man can dance like that *naturally*.

Physical security is the best anyway...

[MosesJones]

Military Sats use encryption for two reasons, one to make sure they can't be cracked, two to make sure they can't be listened two. The second is the more important. As long as the command sequence to the sat is tied to a physical device (which I'd hope at the very least) then your fine as long as you don't get invaded.

The easiest way to secure these systems is to ensure that there is a closed VPN which is tied to two devices, one on the sat, one on the ground. Redundant nodes come into play but its again only the physical that matters.

It takes a hell of a rich hacker to set up the transmission equipment to crack a satellite, and then the sat should just be saying "who are you ?" standard H/W ident stuff should block them off.

Physical rules, if you aren't using H/W paired security then its very worrying as its very simple to do and very standard (I assume it is as anyone with half a brain is going to do that) from then on its just a matter of how important is the information and does it need to be encrypted as listening is miles easier than transmitting.

Re:Physical security is the best anyway...

[MeNeXT]

How can you have H/W ident stuff when you have no physical connection? H/W ident stuff could be emulated.

Re:Physical security is the best anyway...

[haruharaharu]

How can you have H/W ident stuff when you have no physical connection?

Sure could, but how are you going to get the keys? The great thing about HW ident stuff is that the secret key is in the hardware and never leaves. Trying to get it out is likely to destroy the device.

Re:Physical security is the best anyway...

[liquidsin]

How much more physically secure can you get?!?! The thing's in outer-fucking-space!!!

Re:Physical security is the best anyway...

[Bronster]

The easiest way to secure these systems is to ensure that there is a closed VPN which is tied to two devices, one on the sat, one on the ground. Redundant nodes come into play but its again only the physical that matters.

Sure Redundant nodes are essential. How stupid would you feel (and how quickly would you be fired) if a box on the ground died for whatever reason (hardware failure, fire, someone tossed the wrong box) and you couldn't control the bird any more.

So - as a social engineering sort of hacker, probably the easier goal is to go for one of these backup devices - expecially since it's less likely they'll notice it's gone (hard to hide the fact that the primary box is off-line!)

Of course a sensible shop will have secured the backups in a vault somewhere - and I don't even need to mention proper authentication procedures for _removing_ this thing from the vault - so I can't turn up with a stolen uniform pinched at the cleaners and lift int.

Re:Physical security is the best anyway...

[MosesJones]

Unique key stuff, two pieces of hardware driven off the same algorithm with the same base, odds of matching it are practically zero. Physical connection isn't required its about the integrity of the two devices.

Re:Physical security is the best anyway...

[MosesJones]

Err the normal configuration is to have all nodes in a redundant loop so their isn't a single point of failure. But you bet it will be noticed if the number of nodes in the ring goes down by one.

Big flashing lights

Re:Physical security is the best anyway...

[Anonymous Coward]

I think the security being referred to was at the uplink site, not the satellite; search for "Captain Midnight" to see what a disgruntled satellite operator can do..

Re:Physical security is the best anyway...

[shogun]

Might make it a little harder ot physically pull the plug on it when you realize its been taken over by someone else though...

pointing at the sat?

[Niksie3]

I'm no expert but I assume that in order to give commands to the bird you would want to know where it is located in the sky, if you could keep that info secret I think ppl will have quite a hard time to find it.

PS: this ofcourse would only work if it doesn't communicate with joe average. If it would you could probally use multiple dishes to figure out where it is located

Re:pointing at the sat?

[Anonymous Coward]

Actually where a satallite is in the sky is public info. there are a lot of good sat tracking programs you can get off the net.

Re:No.

[Anonymous Coward]

HAHA!

Big antenna: easy

[Anonymous Coward]

Back in my university days they had an "antenna farm" out the back of the electronics department. Now one of these arials consisted of dozens of dipoles strung end to end over a length of about 200 meters. This "string" sat above a V shaped wire mesh. This thing was used to listen to satellites as they passed through it narrow beam width. Well if it can recieve it can also transmit effectively. My point is that if one has a large garden and a few rolls of checken wire then a large arial is not out of the question.

My thoughts

[Mercenary]

Reverse engineering the protocol certainly isn't impossible, and whether anyone is going to attempt it is hard to predict. You only have to capture the imagination of one cracker for them to have a go. So, clearly, you should NEVER assume that, "Well, no-one will care... it's only a satellite".

And, let's face it, this is the sort of thing that some geeks would consider the ultimate war-drive. ;-)

However, opening up the source completely here could be problematic in one way: You may not get a second chance. Someone may find a major flaw, exploit it, and ... ooops - your satellite has landed in the North Atlantic. It's a bit late to fix it though!

This is one reason why you don't let hackers work on air-traffic control systems. ;-) (troll)

Huge arrays NOT required.

[Cwaig]

I used to work for BAe Space Systems, and once a year we used to teach part of a course at one of the UK's Universitys (cann't remember which). Part of the course was a practical project building a groundstation from scratch using off the shelf kit and making the dish from scrap parts. It's not cheap, but it's within reach of a lot ot western tech heads (but ok, not your average script kidde). I've still got the course notes + designs in my attic....

It's easy really

[Merkins]

You just need to take all the I.P. addresses offline while your goons chase Ryan Phillipe around the building.

Is deciphering necessary?

[Erasmus Darwin]

"2. How many of you think that you could decipher the structure of the command (given the motivation)?"

Depending on how the protocol's set up, this may not even be necessary. If replaying a previous set of movement commands causes the satellite to move some more, you've already lost that battle. The net result is that an attacker can drive the satellite off course and deplete its fuel reserves, making it a floating piece of junk.

Of course it may be that there's a sequence number in the commands that needs to be updated (most likely to prevent inadvertent duplicates due to transmission problems). In that case, it'd actually require some deciphering effort. Still, remember that you lose as soon as someone figures out enough of your protocol to move the satellite around. An attacker doesn't need to figure out every little detail.

Finally, there's always the social engineering approach. If the attacker can get the protocol by creatively lying to people at your organization (or just by getting a job there), then not only do you lose, but the attacker would have enough information to theoretically do something really fun (like trying to get the satellite to reenter the atmosphere in such a way that the attacker can watch the light show). That further cranks up the attacker's motivation to carry out the plan.

Throwing down the gauntlet?

[TheGreenLantern]

How many of you think that you could decipher the structure of the command (given the motivation)?

Man, isn't that a little like asking a bunch of high-school/college jocks if they think they could go one-on-one with MJ?

"Uh....yeah, I could do that! I mean, I'm a little out of practice and all, but shoot, I used to be able to hang with the best of them in my prime. I'm sure I could manage, if I was motivated enough!"

Hacking a freaking satellite with no knowledge of the command structure would seem to me to be one of those uber-hacks, on scale with bringing down Ma Bell for a few hours, or finally tracking down the true identity of Signal11. In other words, it's probably possible, but you're not likely to find anyone around here that could do it, regardless of what they might tell you.

Re:Throwing down the gauntlet?

[Anonymous Coward]

Who is Signal11?

Re:Throwing down the gauntlet?

[Anonymous Coward]

shhhhhhhhh... be careful lest you rouse CTHULHU!
(S..11 is a AI derived from the usenet K_ibo code. It is designed to mercilessly troll slashdot. It is a thing both subtle and terrible. But it is not King of the Trolls.)

Security analysis

[Proaxiom]

I'm not looking for the Slashdot population to do my research -- I mostly want opinions on whether cracking a science satellite would be worth the time.

I'm not going to analyze the up-link protocol or try to brainstorm motivations for cracking your system, but as a security professional let me try to clarify the issue a bit.

You are on the right track with your questions. You are trying to figure out: a) how badly does somebody want to crack it, and b) how difficult is it for him to do so.

These two factors are precisely what define security risk. If the cost of breaking a system is greater than the reward for doing so, your security is adequate.

The first question cannot be answered by the Slashdot crowd. There are too many variables. Who are your competitors, and how much to they have to gain by sabotaging you? Could the satellite possibly be used for anything other than its intended purpose if control was usurped? How valuable is the satellite to people other than you if it is only being used for its intended purpose?

Perhaps people here could try to figure out the 'cracker bragging-rights' factor, but I suspect that would not be sufficient motivation to go to the lengths required to break your system (any glaring security holes notwithstanding).

From what it sounds like, the second question can't be answered by anybody. The rule of the day is 'provable security', which is why security by obscurity is frowned upon. It's not that it doesn't work, because sufficient obscurity is indeed security, it's that you can never be sure how well it works. This was the problem with the German Enigma machine in WWII, which ultimately provided the greatest incentive to proving lower bounds on security.

Encryption provides easily quantifiable security, demonstrated by mathematical proof (with the minor caveat being most of these proofs rely on P not equalling NP). The techniques you describe do not sound like they lend themselves to provable security. (Although physical security is usually considered pretty sound, provided it is comprehensive; this includes isolated networks and site protection, as you describe)

How difficult is it to gain access to a powerful radio-antenna? That's a key question. If the satellite is owned by a company in an industry with cutthroat competitors who also have satellites, it might not be difficult at all.

Re:Security analysis

[vkt-tje]

Could the satellite possibly be used for anything other than its intended purpose if control was usurped?
You never know what comes out of the brains of some techie.
Who would ever have thougt about...
...a text-mode Quacke (only yesterday)?
...runig Linux on a game console (few weeks ago)?
etc.
Then I don't count all aibo and furby hacks and all other stupid things we do with our computers.
A hacker will probably first get into the system and then find things to use it to his/her benefit and enjoyment.

Has it already be done?

[thogard]

If you look at the GPS sats you will find they transmit a an encrypted signal for military use. If you have the crypt code you can decode the stream and figure out where the 1st bit is which signals the start of a frame. Inside that frame you get enough info to tell how far away you are from it. Someone (at Trimble?) figured out that the last bit of the frame is truncated so the timing packet always starts a the right time. Now the survey grade GPS recivers just look for a bit that is jsut a bit wrong and use that. They pick up the other timing signals from the other frequency and store the data. You can compare that later and do some high precision work (some claim sub mm).

Another thing is the GPS sats used to shift their packets a bit to throw off the Russians (who had a better system). Someone (claiming to be Russian) posted polynomial to usenet describing it. That was a major part of its security. (and I'll have to dig up that post now that google has stuff from the dark ages)

The last secure by obscurity one way hash I cracked took me about 3 days. It wasn't nearly as good as they would have liked.

Based on some of the things I've seen...
give some of my friends a good reason and enough to play with your toys and you might see a cool reentry.

If what your playing with can be a weapon, call your local spooks and explain the situation to them. Its in their best interest not to have your bird go down. The NSA does have a group that may provide some very useful to your company -- they were providing some good ideas on one project I was involved with for a while for a well known company.

Re:Has it already be done?

[Andy Dodd]

The Trimble and other dual-frequency civilian GPS units don't crack the encryption at all.

There are two uses for the P code (encrypted version is the Y code) - For one, it's inherently more precise (higher bitrate, I assume). For another, it's broadcast on two frequencies, which allows for ionospheric delay to be precisely determined (one signal will arrive earlier than another.)

But because the transmitted Y code is EXACTLY the same on both frequencies, you can just correlate them to figure out the time delay. Problem is, because the code isn't known in advance, you must have a high SNR and it takes a while to lock onto each signal. So it's only good for stationary surveying receivers.

To achieve sub-millimeter accuracy, you need to perform calculations using the carrier phase in addition to code ranges. Again, a stationary receiver with long (1+ hours) sampling periods is needed. In all of these cases, the data is post-processed in an advanced form of DGPS.

NASA Memo explaining COMSEC requirements

[braddock]

Here is a memo that explains the National Policy on Application of Communication Security to U.S. Civil and Commercial Space Systems, NTISSP No. 1.

http://www.tscm.com/communsec.html

Some excerpts:

The need for and means to protect the command/control uplink associated with civil satellite systems, intended exclusively for unclassified missions, will be determined by the organization responsible for the satellite system in coordination with the National Security Agency....

...Approved techniques as they pertain to space COMSEC equate to National Security Agency (NSA) endorsed encryption and authentication systems....

..Government or Government contractor use of ... commercial satellites ... shall be limited to space systems using accepted techniques necessary to protect the command/control uplink.

Basically, if your group is doing as little as what you say they're doing, they may be in violation of law.

--Braddock Gaskill

Re:NASA Memo explaining COMSEC requirements

[gorilla]

Basically, if your group is doing as little as what you say they're doing, they may be in violation of law.

Only if it's a US company. Most commerical satellites are launched by ESA, which obviously doesn't follow NASA regulations.

Not Encrypted?

[wafath]

0) It's not encrypted???? All satellites I have worked with are encrypted at least on the uplink, including science ones. (even deep space science satellites that require big dishes to talk to it.)

1) It might be more useful to look at this scenario from the electronic warfare point of view, not an internet point of view. However, unlike the internet, you need large, dedicated, expensive equipment to uplink. The equipment is not outside the reach of many hackers, but very very few have them.

You need a license to do the kinds of broadcasts needed to command or jam a satellite. because this is a rare event, your best bet is to handle this through FCC and like organizations. (unlike internet hackers, the FCC will take this seriously.)

2) Yes. Especially if you base your spacecraft on a standard bus. If you do, most of the syntax may already be public. And if I have your telemetry database and a decent history of commands and telemetry, I could figure it out. It isn't easy, and it isn't quick, but it could be done.

Besides, chances are, I don't need to send a good command to destroy your satellite. Just turning on one of the rockets and putting it into an uncontrolled spin will do it. There is a non-zero chance that if I get your spacecraft to accept any command that I could destroy it, even if I have no clue what the command did.

3) Most of the protocols are to use internet protocol to form an intranet between the ground control centers and the spacecrafts. This is mostly floated around as a method of constellation management, because CCSDS is just silly with a solid-state spacecraft. No one in their right mine would make a functioning satellite pintable from any moron on the internet.

W

Another Randal Schwartz?

[Gid1]

This sounds like another one of those ill-conceived "My boss isn't listening to me, maybe I should prove I'm right" crusades, like the one that got Randal Schwartz in trouble.

My advice: Don't rock the boat, especially in the current economic climate.

Instead, when you get that "management are morons" feeling, just imagine a taxi meter above your desk and calculate how much money you make taking a dump on the company's time.

satellite topsite

[cmckay]

Well, if the satellite has a few GB of storage...

Given the recent shakeout of the warez scene, I can see many benefits to running a topsite on a hacked satellite. (Assuming, of course, it were possible to conceal the transmitter/receiver antennae required to interface with it).

Or you could just install the latest distro of Slackware on it and post a link to slashdot. Then we could have the first ever slashdotting of a LEO device!

Muwahahaha... er... nevermind.

Re:satellite topsite

[Hast]

Considering that most sat's don't even have 486 grade processors it seems highly likely that they would have a few GB of storage.

Me, sarcastic?

Obscurity and Security

[rknop]

Obscurity really is security, if it is true Obscurity. For instance, if you've written a custom server with a set of commands, and you run it on a single computer somewhere on some random port, chances are it's not going to be hacked unless somebody smart and dedicated specifically targets you. Yes, you'd be more secure if you wrote the thing to encrypt its communications and made damn sure that it was robost-- but saying "probably nobody will notice me" has something to it if really nobody likely will notice you.

The problem with companies like Microsoft arguing that obscurity is security is that they don't have real obscurity. Their operating system is absolutely all over the place, both physically and in terms of network connectivity. As such, there is both ample opportunity and ample motive to find out hidden facts about it. While those facts may be hidden, the OS is not, so there's no real obscurity, just a thin veil of obfuscation.

If you're building one new high-tech stealth bomber, and you do it in a hidden valley in some very remote site, and completely underground, chances are it's not going to be seen. On the other hand, if you build several prototypes in downtown parking lots of major cities, and just drape a cloth over them with a sign "no plane here", that's just the illusion of obscurity (and hence the illusion of security). Major OSes that are widely distributed but which hide their source code are much more in the latter category.

As for Satellites-- their obscurity probably is worth something. It's only one link, and the need to have the broadcasting station is a huge barrier. On the other hand, they can be highly visible targets, and I'd suspect that they aren't as obscure as one would really like to be to think it grants you some security. They probably ought to start using, as a matter of course, real secure protocols.

-Rob

Re:Obscurity and Security

[roystgnr]

For instance, if you've written a custom server with a set of commands, and you run it on a single computer somewhere on some random port, chances are it's not going to be hacked unless somebody smart and dedicated specifically targets you.

Or unless somebody scripting and kiddieish specifically downloaded a port scanner. Are you absolutely sure that said kiddie isn't going to learn anything useful (or do any accidental damage) to your custom server just by sending and observing responses to random data? Maybe he'll find it hard to get a root shell without his own copy of the software to play with, but I'd be worried about denial of service attacks too. When I see "secret custom server" I read "software whose hundreds of system-crashing bugs in response to unexpected inputs still haven't been discovered".

Re:Obscurity and Security

[rknop]

Or unless somebody scripting and kiddieish specifically downloaded a port scanner. Are you absolutely sure that said kiddie isn't going to learn anything useful (or do any accidental damage) to your custom server just by sending and observing responses to random data?

No, not absolutely sure, which is why you're better off with real security. On the other hand, most script kiddies don't really know what they're doing, and are quickly scanning lots of computers for known vulnerabilities. Unless you had the very unlikely misfortune of writing something whose protocol exactly mimics the behavior of a well-known server vulnerability, you're just going to get some errors and dropped packets on your server, no security vulnerability.

The "custom server" should have at least enough error checking to ignore something it completely doesn't understand... otherwise it's not very robust at all, and will crash all the time, even if nobody is trying to hack you. However, ignoring what you don't understand is very easy to do; anybody who's ever written a CGI script has done it.

-Rob

Why is this in the spam category?

[Geoffd1]

Seriously. Is it really spam-related?

Re:Why is this in the spam category?

[resonator]

Ummm... maybe because the article is about spattelites (?)

security

[Eon78]

As most of the people who will read this, I have no hands-on experience with satellites. So basically I don't think you ask your question to the right audience. Then again, you only want opinions, and that I can give you :)

Question 1. I think you can do a DOS attack, provided that you have a strong transmitter. I have no idea what they cost, but I think you must be pretty badly want to do this, since these kind of transmitters probably won't come cheap.
Probably a weaker tranmitter can do the trick if the distance from the receiver is small. If the receiver is standing at large site, and that site is well secured than this probably won't be a problem.

Question 2. Deciphering the command structure will probably not be that difficult. Especially not if you know what you are looking for (kind of data). As you said before, it is not encrypted.
I figure that if you can afford a receiver/transmitter to sniff the connection, or to do a DOS attack, that deciphering the command structure will be peanuts.

Question 3. If you (or your company) is concerned with illegal access than hooking it up directly to the Internet will probably not be a good idea. Furthermore, it would be wise to implement your own level of encryption over IPSec so that you can easly implement stronger encryption when needed.

Most importantly: is it worth it? I think not. Transmitters/receivers are specialised equipment (thus also probably very expensive). When you succeed to hack/crack a satallite then what? You have access to gigabytes of mostly useless data...

This goes for Joe Hacker. If you're talking corporate-espionage that's a completly different story... But I also don't think it is really worth the trouble for them...

True story

[Anonymous Coward]

Scientific satellites usually don't have much security. I wrote a script in tcl/tk once that created a set of satellite commands. The commands were transfered by ftp (perl) to an ftp-site where it got placed on the command queue.

You don't get much cpu-power in scientific satellites because they have to use CPUs certified for use in space. I might be wrong, but I think we used some Texas Instrument CPU från 1976 (they built the satellite in 1997). That means that ssh or ipsec would be useless.

We lost contact with the satellite after 5 months in space.

DoS and control of a satellite

[genka]

When I was working in a sat related field, I was told that huge dishes seen at major telecom companies sites are designed to have enough output to overpower any rogue control signal or DoS attempt. I think that figuring out how to control propulsion system by sniffing the control signal is difficult, if not imposible. One will need access to some serious astronomic equipment. Then he will have to monitor position and speed of the bird for very long time to see how it responds to the command, because firing the engines is a rare event. I doubt that sats can be controlled with precision needed to ram it into another one.

Re:DoS and control of a satellite

[Anonymous Coward]

One would not need a powerful antenna if the control antenna were taken out (physically) or jammed. Think "large array of can-opener motors at close range" or "a flock of pigeons dressed in tinfoil" *chuckle* Okay, maybe those aren't viable possibilities. Maybe "a flock of pigeons dressed in C4 or Semtex." Or an EMP. Such would be a bit tricky, and a bit pricey, as it would almost certainly require a team of folks to pull off the job.

Given enough time, and given that you could also recieve the signal back from the satellite, you could probably figure out the control protocols.
That may not be necessary, however, if the objective is not to control the satellite, but to render it inoperable. If there's not a lot of processing power onboard and if the error-handling/command parsing abilities are not very sophisticated (I would assume that both are the case, if you've not got a lot of power and you've not got a lot of storage, you have very small, streamline commands, and you probably assumed that the spacecraft would be getting valid commands that have been checked and doublechecked and triplechecked by ground control before they're sent up, all the time.) then probably simply flooding the thing with a lot of random characters would be enough to break it, or maybe hit a command or two by accident.

There's probably no additional danger to making your satellite "just another node" on your network. Provided your network is secure, that is.

Honestly, though, if I were a hacker going for your satellite, I'd work from the social engineering standpoint. Rather than try to hijack the signal from outside, I'd try to get inside your organization, either by stealth, or by getting a job there. Probably the easier way to go.

Re:DoS and control of a satellite

[Anonymous Coward]

> When I was working in a sat related field, I was told that huge dishes seen at major telecom companies sites are designed to have enough output to overpower any rogue control signal or DoS attempt

Two words to Google for: "Captain Midnight".

Re:DoS and control of a satellite

[uspsguy]

I think it far more likely that big dishes are there to do a good job of receiving a very weak signal from a long way away. Satellite customers don't like noise and dropouts.

Comment in the obscurity vein

[psychosis]

Just a quick comment - I wholeheartedly agree with the "security through obscurity is a bad thing" thought process, but when combined with other security features, as outlined here, it can be valuable. The best way to incorporate hidden features of your security plan is to "open" those features to a peer review of trusted (and NDA-bound) experts for their input. The number of experts is up to you, so make sure you balance "need to keep secret" with "enough insight to be valuable".
This way you can avoid the folly that one person's ideas are failsafe (they never are, after all), while still keeping the details from massive public consumption.
A poor analogy (but the only one I can think of right now) would be the details of the presidential security detail. By not publishing when the motorcades and aircraft will be moving/flying, the Secret Service adds a layer of security to the already armed-to-the-teeth plan. Relying exclusively on one or the other would not be enough to consider bullet-proof (no pun intended), but combining the two offers a degree of synergy, strengthening the overall plan.

Crashing a satelite

[TMCGames.com]

breaking into an orbiting satelite would be muchos hard work but imagine the consequences ?! I think the western world would say "how high" if somebody rang up and said something on the lines of "hey, I have control of this satelite, Im aiming it for touch down at xxx location". no encryption in my view is inviteing someone to have a poke arround.

Real answers...

[rcw-work]

Can someone effectively execute a DOS attack by uplinking to the satellite with a powerful signal (the frequency would be easy to 'snoop' from our transmitting antenna), thus preventing us from commanding it?

Absolutely. Amateur radio operators have worked earth-moon-earth on 144 and 440mhz for decades - there's no reason someone couldn't build the equipment to do it on your frequency. However, the antennas and such are rather obvious-looking. Any nation's communications commission would be able to spot one of those very easily in case it needs to be hunted down, and it does raise the bar beyond what most crackers are motivated to do.

In general, how do receivers handle multiple command carriers (would there be too much noise to command)?

The mathematical formula for this is Shannon's Law. Run your numbers through it (and keep in mind some modulations have significant inefficiences of their own). I can't imagine missing a couple communications windows with your satellite would be the end of the world, though.

...tell me if you think it is secure, or whether you'd want to crack it.

For something with the replacement cost of a satellite, you want guarantees, not estimates of society's intentions. If you want your control center to be the only station capable of transmitting commands to the satellite, your satellite needs a way to make sure it's the control center that's doing the sending. If you want to make sure your telemetry data is from that satellite, you need to make sure it's the satellite that's doing the sending. Note that encryption isn't really needed here (a cracker knowing what you're doing with the satellite doesn't help much, as this is not a spy satellite) but some form of public key signing should be employed. It also guarantees that your control messages won't arrive corrupted (although I'd imagine you'd already have something to protect against that).

Linefill?

[Bender Unit 22]

Another used method is filling up the connection with "noise" so that the line never is idle. I don't know if it is a good idea in sat. communication. besides from encryption, it always makes it harder for those snooping if the line never idles. So you can't tell from the traffic if there is any actual communication or not.

Two solutions

[jmaslak]

1) Use some sort of encryption-related technology, like MACs (see my other post)

2) Use some sort of phased array receiving antenna. These can select what direction to listen to a request from. That means that someone would have be in your geographic area or have an EXTREMELY strong antenna (much stronger then yours) to do any sort of DOS or even send legitimate commands.

some thoughts

[Anonymous Coward]

1. Can someone effectively execute a DOS attack by uplinking to the satellite with a powerful signal (the frequency would be easy to 'snoop' from our transmitting antenna), thus preventing us from commanding it? In general, how do receivers handle multiple command carriers (would there be too much noise to command)?

I seem to remember something about the U.S.A. trying to send propaganda via the radio to Cuba, using hugely powerful transmitters, and Castro preventing this with the use of a relatively small jammer. Anyone else remember this? Anyone know of any information sources on it?

2. How many of you think that you could decipher the structure of the command (given the motivation)?

It's very possible. Wasn't AOL's communication protocol private? How many AOL speaking programs are there out there now?

Re:I assume the run of the mill reply to this is..

[liquidsin]

I'd say a better idea is to use Microsoft's Windows XP Embedded. Run IIS on the satelite and use a web-based interface for administration tasks. No special software needed - just your IE 6.0 browser that came pre-installed on the home version of XP you purchased (after all, the browser IS the OS). Plus I've been assured that it's entirely secure.

Security is NOT optional...

[Anonymous Coward]

You MUST secure your satellite command and control system. This is NOT an option, it is a requirement.

Some background for my opinion: I work with these systems, developing satellite command and control - I'm not The Man in this area, but I'm on a team that's competing to build a USAF command and control system, and I'm currently working on developing the network operations center for a comsat system. I'm not Mr. Security, but we've had conversations - get it?

To address your specific concerns - yes, someone can "blind" the command uplink, but you can usually do something about that legally - someone radiating that amount of power gets noticed. It can be done, but there are countermeasure that can be taken - encrypted in-band commanding is popular on comsats. People can decipher command structures, esp. if you're using a COTS satellite bus - and most science missions starting out today use one as a point of departure. In fact, you can probably get hold of the base command structure for some early satellite families and extrapolate from there. The "standards" being worked on are a long way from ready for prime-time - I don't know anyone willing to entrust a hundred-million or billion-dollar comsat to them. The US gov't. controlled encryption systems are still the standard for the command link in the systems I'm seeing (I do work in the US).

Will people hack science birds? Depends on what they do, and how bored the "people" are. There are a lot more gratifying things out there, and hacking a science bird would get a lot of bad press - but some folks live for bad press. Don't just rely on physical plant security - you can't put a security guard on the bird, and remote links are always vulnerable if they're not sufficiently secured. Go do research, and ask some of the COTS command-and-control companies (Integral Systems, or STI (now part of Harris) for advice - they'll try to sell you product, but it's worth it to listen.

Good luck.

Re:Forget reverse engineering -- who's quit lately

[mclinc]

8mm tape! LOL

How much cash would it take to make a programmer with access talk?

Very little cf. with the cost of the craft if there like anyone I know!

SSL-Encryption

[alek202]

I don't know how exactly Satellites communicate with the base stations, but since they have (as far as I know) similar command structures (see the Astra information video: "The SES Astra Command Station in Betzdorf / Luxemburg is able to control satellites in their range on demand and/or in emergencies"). Hacking satellites is not a question if anyone would do it. The question is: "What can we do to prevent it?". You never know what intruders have in mind when doing such things, and you also don't know if they can. I don't know the data capacity of the uplinks/downlinks for satellite control, but isn't it possible to encrypt the data flow with ssl or similar? A well worked-out security concept is a MUST, especially if you think of that satellites cost alot of money (ranges up to unlimited, plus rocket carrier and more).

- Timo

Hacking a sat is like reinventing the wheel...

[sluggie]

Why should anyone want to explicitly hack the sat itself?
With all the posts above (or below.. whatever) describing how hard it would be to talk to a bird, I would say that hacking the ground station is much easier.

Think about ex-employees, some social engineering, exploitable firewalls, stupid proxy flaws, "unguarded" workstations etc etc.

I think it's not how do I secure my sattelite, it's more about how do i secure my office at all, because this IS the weakest point of this chain of communication.

Having the best hardware/software encryption doesn't help much when someone installs such trivial things like keyloggers etc...

Your three questions

[Dunall]

With also being in Satellite control field (military) I can offer insite as to how we addressed these problems.

1. Jamming the uplink.

Jamming the uplink can be done, however once it's done, it is easy to find out who is doing this and easy to fix the problem. Since you're in the field, I'm sure you know all about squelching on particular rx beam channel (The main rxing antennate is usually as simple as a honeycomb of waveguide).. All military satellites can give a Lat and Long of the jammer if the threshold is set low enough.

All military and major commercial satellites have a redundant, out of band uplink path that's available to the command.. This is usually in the VHF frequency range (as opposed to the GHZ range for comms uplink) and is used for C&C only. This channel usually requires special encryption and commanding sequences, however if both were jammed, you'd be blind until the jammer was brought down. All the satellites that I've worked on has had protection for jamming though.. A few have had systems that would shut off particular beam channels for a given time if they detect a jamming signal.

There is also the issue of communications protocol.. Most of the systems that we worked with didn't only use encryption, but also particular protocols that wern't widely known.. Here's where obscurity can lend a hand.. though everyone's right.. it's not effective.

2. Can it be hacked...

This has already been answered... It probably can, but if the satellite designers had half a mind, it'd be hard... and any attempts to test uplinking would be detected pretty quickly.

3. Satellite Internet Node.

Secure or not, it's just not a good idea. Granted, it'd make it easier to get information across either the atlantic or pacific, but with fiber optic systems and the bandwidth that they'll be capable of transmitting these days, it's more cost effective to use a trans-oceanic fiber (When you consider the cost of funding launch, uplink and downlink equipment, maintence of flight path and satellite system etc...).

Cryptography & certificates....

[Anonymous Coward]

If the only thing you want to protect is the commands sent to satellites, use certificates to sign every command (with ad-hoc software on the satellite to check signature) to ensure the satellite won't execute unsigned commands. Else, if everything has to remain secret (I mean both up & down data streams, a public key/private key encryption system is recommended (rsa with at least 4096bit keys should do the stuff safely for at least the next 5 years according to bank security advices). Anyway, avoid any "secret" encryption scheme as those "secret" schemes are not always mathematically proven to be safe. RSA will remain quite secure as long as your key are correctly generated (and no one gets them) and no one discovers a way to factorize big numbers. Bests

Re:I assume the run of the mill reply to this is..

[Anonymous Coward]

Amazing. Utterly amazing. A question about satellite security ends up with a Microsoft bashing comment. You forgot to ask if the satellite is running Linux and if there is enough storage space for a few DivX'd anime episodes...

Security in depth

[Bryan Andersen]

Use security in depth. I would recommend using all the layers of security you can.

Physical, keep that network you communicate to the satalite separated from all other networks.

Encryption, I'd recommend encrypting the uplink command stream as a minimum. Encrypting the downlink would also be good. This makes the pool of information about what was done small and thus makes crypto analisys harder. Temper this with the fact that all known encryption methods can be brute forced with enough time and CPUs. The encryption is there to make the job harder.

On going to standard IP protocals for talking to the satalite, I'm not convinced it is needed and may be detrimental security wise as it provides a more common element that can be worked from. On the other hand if the protocals have a good security setup in them that is proven secure, then it would be better than developing your own. At this point any security relaying on digital information can be faked. There is no absolute security in the digital world.

What I would do: Keep the network physically separated from all other networks. Keep the protocal secret as nobody else needs to know. Encrypt the uplink and downlink data streams. For the encryption methods, I would choose well known and throughly checked out methods for setting up and maintaing keys, etc. It would be best if the keys are rotated often. This helps keep down the possibility of a key being brute forced before you stop using it.

Satellite Security

[Logika]

1. Yes, someone can execute a DOS attack. It's called jamming and was done in the 80s to HBO by Captain Midnight. You need to check on the specific satellite design and see how the receiver would handle it but bear in mind that generally they will look for the best SNR and go with that. If the transmitter is higher power than you are, the receiver will see your signal as simply noise.

2. How many of you think that you could decipher the structure of the command (given the motivation)?

2. Deciphering the structure of the command is not going to be easy but it can be done. This is not something for script kiddies but the true hackers with sufficient motivation will eventually figure the problem out. Remember, with Real Hackers, simply the doing of something neat is sufficient motivation -- but a Real Hacker also subscribes to the Hacker Ethic of doing no harm.

3. I think the simple cool factor of getting into a "NASA Satellite" would be sufficient motivation for some of the budding anti-social geeks. Satellites are extremely high-value assets and should better security than how we protect our webpages. However, securing them also goes counter to the way most scientists want to work. Luckily, the command and data streams should be using different signalling systems and freqs so you CAN have the best of both worlds.

4. I would not assume your network security works. I seem to remember something about someone getting into ESA's system; it was postulated as a possible reason for one of the Ariane failures resulting from bad design. Personally, I think the French just wanted to toss the blame off on someone else but the more the US government relies on Microsoft systems, the less secure your system will be and your security is only as good as the weakest point of entry.

Re:Satellite Security

[Dunall]

You really have no idea what your talking about do you? You haven't even taken into account polarization of the signal.. Most satellites have multiple forms of signal polarization (cross polarization being the most common on satellites now and circular polarization more common on military).. Assuming you can get the signal polarized correctly, you still have to know the specific uplink frequencies for C&C on the satellite. Some satellites are now also using SSMA for their uplink, making satellites that more untouchable by people who think they can hack... FYI, SSMA is less succeptable to s/n degedration than a CW carrier.

1). DOS? Yes, fairly easily. With the programs available now, it is fairly easy to construct an antenna with the sort of gain needed to jam the receiver inputs. The need here is not to take control but deny you control. This can be as simple as just degrading the s/n ratio to the point where you are lost in the noise floor or can't stand out from the crowd. By sending up a signal with noise on it, what you hear is noise. Hard to tell if you're being jammed or just having noisy conditions. In this case you've been jammed, causing DOS and may not even know it. Then there is the case where they just send up a signal with the intent of jamming the input and letting you know that you're being jammed.
What you lack in raw output power can be compensated for with antenna gain. Odds are you're using short wavelengths which allows you to build "death ray" (very high gain) antennas that really aren't very big. Or use several linked together which makes them even smaller. With a combination of high gain and narrow bandwidth, not only can they deny you access to your bird, but they'll be hard to trace because of the narrow beamwidth. Nowadays, with the increased interest in amateur radio satellite operations, the eqipment needed is cheap and easy to obtain and can be masked as a "ham" setup. There are now solid state options that allow a small transmitter to be constructed capable of 100 or more watts that can do the job. I've seen satellites "captured" with 100 watts and a 23db portable antenna.

You're asking this on Slashdot??

[duffbeer703]

People here have even less of a clue about satellites than they do about copyright & patent law.

If you are not a troll, then YUO=FUCKED.

Man your satellites!

[redmoss]

Yes, this is a bit far-fetched. At some point it will become necessary to put full-time security people on satellites anyway, since other people might try to hijack the satellites. Heh, I guess that would be "physical security". So anyway, this is most probably not a viable suggestion for you, I'm simply prognosticating. Of course, having people on board *would* make it easier to recover from a hack attack (unless someone had bribed the security people).

Re:Man your satellites!

[Anonymous Coward]

Commercial (comsat) developers and operators HAVE security people, and they take things seriously.

Then, to top that, there are the Commerce and State Department restrictions on satellite technology in the US... so non-citizen access can be monitored. Think we're paranoid enough yet?

ssh

[kluro]

Never *ever* log in to your satellite using telnet/rsh. Allways use secure shell. And use a password that is *at least* 8 characters long, with both small and capital letters (no qwerty). Yes. That should do it.

Re:It depends ...

[Anonymous Coward]

Come on now. Electron microscopes hardly involve optics at all. Beside that, I happen to think Natalie Portman has nice breasts. You just don't appreciate a fine work of art.

Re:Forget reverse engineering -- who's quit lately

[pointym5]

8mm tape! LOL

Note that I didn't type, "6250bpi spool" :-) And I just threw out a few of those old cartridges with the metal plate on one side; what were those called? Anyway, so I'm old, and the last time I put something on a tape it was 8mm.

How much cash would it take to make a programmer with access talk?

Actually since I typed the original note I've been trying to figure out how to work the "sex" angle. I know a few secrets, probably.

Uploading

[wiredog]

uploading a new program may be a problem - debugging would be a nightmare

That's why you debug using duplicate equipment on the ground. That's how JPL does it. They've reprogrammed interplanetary exploration vehicles such as Galileo, for instance. It's not a nightmare, but the latency (8 hours round trip to Galileo) is a hassle.

Since you won't be working in the Mill

[Anonymous Coward]

Under 2 hours?? I assume you are planning
just to watch and not be directly involved
in the fixing.

While security through obscurity is stupid
by itself, it is still a valuable component
for an expensive satellite operation.
Probably releasing components of your
protocol and authentication methods
opensource and not leaving a breadcrumb trail
back to your company and business sector
would be best.

Re:Since you won't be working in the Mill

[cscx]

"Under 2 hours?? I assume you are planning just to watch and not be directly involved in the fixing."

Ahem. The phrase "under 2 hours" is the Linux/OSS version of Domino's Pizza's "30 minutes or less" slogan. Just look at this quote from this article:

"Almost as soon as a bug is discovered, a fix is developed. An example of this is the "ping of death" bug - there was a patch out in just under 2 hours, and it was only that long due to the fact that no Windows machine could be found for testing!"

So, in a way, yeah. "Under 2 hours."

Satellite Security

[Marcus Erroneous]

1). DOS? Yes, fairly easily. With the programs available now, it is fairly easy to construct an antenna with the sort of gain needed to jam the receiver inputs. The need here is not to take control but deny you control. This can be as simple as just degrading the s/n ratio to the point where you are lost in the noise floor or can't stand out from the crowd. By sending up a signal with noise on it, what you hear is noise. Hard to tell if you're being jammed or just having noisy conditions. In this case you've been jammed, causing DOS and may not even know it. Then there is the case where they just send up a signal with the intent of jamming the input and letting you know that you're being jammed.
What you lack in raw output power can be compensated for with antenna gain. Odds are you're using short wavelengths which allows you to build "death ray" (very high gain) antennas that really aren't very big. Or use several linked together which makes them even smaller. With a combination of high gain and narrow bandwidth, not only can they deny you access to your bird, but they'll be hard to trace because of the narrow beamwidth. Nowadays, with the increased interest in amateur radio satellite operations, the eqipment needed is cheap and easy to obtain and can be masked as a "ham" setup. There are now solid state options that allow a small transmitter to be constructed capable of 100 or more watts that can do the job. I've seen satellites "captured" with 100 watts and a 23db portable antenna.
2). Crack the operating codes? If you're not encrypting the signals, someone is monitoring them and working the issues already. Why? Because it's there. How did people crack the telephone company switch codes? How did mainframes get cracked? Combination of innate human curiosity and revenge by disgruntled, former employees. Don't fool yourself by thinking some combination won't happen to you.
3). Whatever protocols you go with will be subject to cracking. Just like any other asset on the 'Net, you can't just secure it, you have to keep up with changes.

You'll need to use several different techniques to secure the satellite. Polarization, multiple access frequencies,spread spectrum or frequency hopping, encryption that uses both hardware and software, modulation techniques, time based access and others. The use of a proprietary system limits the number of people that will know it, but doesn't eliminate that information getting out. Look at what happened with the "Falcon and the Snowman" where the spy was selling highly classified and sensitive manuals on satellite operation to the Soviets. A straightforward scientific satellite won't even have the cloak of patriotism to wrap itself in to ward off this type of human engineering.
What is the operation of this bird worth to you? What would it be worth to someone to gain control of it? Now, how expensive and how hard do you want to make it to do that? Imagine your house is worth $250,000. You should probably use more than just a low-end lock set on it. You probably don't need Ft. Knox security. You need something in between and that will be determined by how much you are willing to spend balanced against how likely you are to have to use that expense. Think of it like backing up your server. How much will it cost you if it goes down, and how much will it cost you if it goes down and won't come back up?
I can only hope you know more than you're letting on. Otherwise, that's a telling comment on how little your company thinks of the security of it's assets.

Sure, it's called Jamming, not DoS though.

[Anonymous Coward]

1. Can someone effectively execute a DOS attack by uplinking to the satellite with a powerful signal (the frequency would be easy to 'snoop' from our transmitting antenna), thus preventing us from commanding it? In general, how do receivers handle multiple command carriers (would there be too much noise to command)?

Sure, but it's called jamming, not DoS. There is plenty of problems with unintentional RF interference on space assets. Actually trying to interfere wouldn't be very difficult given a big enough dish and proximity to the uplink site.

2. How many of you think that you could decipher the structure of the command (given the motivation)?

Contrary to what most slashdotters are probably saying, this would be very difficult. I'm not saying you should count on it though.

The problem is that the feedback loop is pretty open because the attacker may have incomplete access to the downlink (and would have to decipher that as well), and likely doesn't have access to other means to watch what a particular command does to a satellite. You may be trying to send a command to fire a thruster or torque a gyro, but if you don't have the means to assess whether you've tumbled the bird, its just guess work.

It's been done before

[Anonymous Coward]

Remember when Garth sent Cassandra's performance to Mr Bigg's limo in Waynes World?

He did have that big fat UNIX book and a geek-garth-gurl....

signals to the satellite

[auroran]

Sending a signal up to a satellite is fairly easy and somthing that ham radio operators have been doing for years. AMSAT is a good place to check out what has already been done as far as getting a signal up to an orbiting target go. Additionally some ham radio operators have opperated at what's called moonbounce or EME (earth-moon-earth) where they send a signal off the moon and back just for a bit of a challenge and the fun of it. There is also information arround on high power transmitters that are used for that. Hams have been able to do that sort of thing for years. Keep in mind though since that information is public others can do the very same thing. Also somone with a malicious intent won't likely be concerned with government communication regulations.
73 de VE6OMJ

DOS

[CopperTop]

It would appear that the current systems will always be vunerable to a strong jamming signal, which may not even be real data. An empty carrier may be enough to mask out your command signal. The only method I can think of that would prevent this would be a CDMA radio link, which can pick out data below the noise floor. Frequency hopping would also be needed to add an aditional layer of security.

Re:I assume the run of the mill reply to this is..

[Logika]

Making the satellite's command and control protocols widely available is ridiculous. There's a big difference between relying on obscurity for your security and using it to enhance your security. There's also a big difference between a computer that sits on the Internet to be probed with all responses available for digital capture and a system that can only be accessed through RF transmission, probably using frequency hopping and digital spread spectrum.

The public doesn't have a need to know everything as long as the company(ies) involved don't rely on that obscurity alone to protect them.

Details of HBO Satellite hack by Captain Midnight

[braddock]

Some of the details about the hijacking of HBO by breaking a communications satellite by John R. MacDougall (who had the night shift at a satellite transmission center with the required equipment) can be found at:

http://catless.ncl.ac.uk/Risks/3.24.html#subj3

This was done in 1986, and MacDougall transmitted a few messages and a test pattern over HBO interrupting normal programming. It seems likely to me he just transmitted video on HBO's frequency, so this probably wasn't a command and control hack.

--Braddock Gaskill

the easy way

[Anonymous Coward]

here is what I would do.

1) dumpster dive on your trash and hope that you didnt shred all your documentation.

2) get a spectrum analyzer put it in my truck and sit in your parking lot and try and grab some examples of your uplinks. this is great for replay of some of your transmissions. like say regular commands to download data etc.

3) I am sure this particular bird has a command structure that is proprietary but usually no one reinvents the wheel, this is the difference between "copy" and "cp".

4) get a job at your employer and read it for myself. go home and send it into the wrong orbit.

5) private network huh! I bet you have at least 1 dial up modem in your shop that I can find with a war dailer.

replaying a command that I sniffed from your dish continously would probably mess you up pretty bad. fire thrusters, or send queued data. doing this all day could end the life of your little bird.

ps: I have access to a spectrum analyzer and access to a 12m uplink dish. But I have much better things to do with my time than flirt with a felony.

Re:the easy way

[Anonymous Coward]

This is all correct, and the easiest way to grab the satellite is always going to be by hacking control of the base station.

Next easiest, of course, is going to be by hacking somebody else's base and using their BFO antenna to transmit from. After all, even if I can hack your sat using my rinky-dink antenna, it makes it rather easy to trace to me. If I use someone else's antenna and a well-enough anonymised connection, I'll be long gone by the time your expensive toy is raining from the sky in tiny flaming pieces.

I'm not sure whether it would be possible to hack more than one antenna and control them exactly enough to simulate a really big antenna, but I wouldn't put anything past the abilities and lateral thinking of nasty bad hackers.

As to whether they'd want to hack your sats - Hell yeah! Control over someone else's satellite? How k3wl is that? Or, for the more paranoid, dropping a satellite into a major urban centre? Using it to smash a military sat out of orbit? There's a lot of uses to a satellite beyond w3 0wn3d j00.

location

[lposeidon]

so where is this satelite at? i wannt point my direct tv dish and see if i can get some info intercepted. or atleast some halfway decent cable tv, or really high bandwith for some fragging.

It's about time...

[Shoten]

This is a problem that has already come to cause others harm. Almost three years ago, hackers seized control of a British military satellite and demanded ransom for it. All that is needed to communicate with these satellites is an antenna, and proper knowledge of the protocols involved. While these things are out of reach to script kiddie types, it's not that much of a stretch for the kind of people you really have to worry about (foreign governments and large/resourceful criminal organizations). So, you should think of these systems as being addressable by anyone. Consequently, I would take any and all lessons you can from the ways that people securely authenticate users on publicly-addressable computer systems.

Re:It's about time...

[devnullkac]

I'm not sure I understand this comment. The very link you reference states that there is no chance the purported takeover ever happened. I agree that governments are the groups you really have to worry about, but it's not clear that weaknesses of this type have already been exploited.

Re:It's about time...

[Merry_B.Buck]

teridon's danger seems even worse that the Brit problem, because he's dealing with science satellites, which release more info to the public than do military ones. His user info suggessts he's discussing the SOHO (Solar & Heliospheric Observatory) satellite, which has already demonstrated a hacker-desirable feature: a buffer overflow in code that caused control problems in the satellite.

Uplink/Downlink details on SOHO are readily available, e.g.:

• Uplink Frequency(s) 2067.271 MHz
• Downlink Frequency(s) 2245.000 MHz
• Commands: 16Khz subchannel @ 2kbps
• Uplink transmitters used: Gladstone, Canberra, Madrid

..IMHO it would be feasible to decipher the command structure, especially because descriptions of the commands being used are published on NASA "project home pages". Encryption would help, but would have to be extended to cover the the networks that author the commands, i.e. Goddard, JPL, etc.

Re:I assume the run of the mill reply to this is..

[liquidsin]

It was actually a joke, in reply to the original joke about making it run linux and open-sourcing all of the protocols. Some things are meant to be funny...read up on it sometime. Besides, you don't need storage for anime...it's a satelite for chrissakes, just use it to beam down signals of whatever you want. Twit.

p.s. - yes I realize that I'm replying to an A.C. post and am simply fanning the flames...I just don't care.

Biggest Threat is your internal employees

[rveno1]

Your Biggest threat is not a Cracker or Hacker. I beleive that it would be a rougue employe who was recetly fire/paid off who would cause the most trouble. I would advise looking at creating an encryption authentication just for this reason.

Worth the trouble? And Breasts

[metrix007]

Why would doing anything to a satelite be worthwile? Unles you can eavesdrop onconversation, zoom in on Saray Michelles breasts, or shoot lasers, then it seems pretty useless.

I dont think a satelite can be used to crash, doesnt it burn up as it renenters?

Liability for satellite owners

[Anonymous Coward]

1. Can someone effectively execute a DOS attack by uplinking to the satellite with a powerful signal (the frequency would be easy to 'snoop' from our transmitting antenna), thus preventing us from commanding it? In general, how do receivers handle multiple command carriers (would there be too much noise to command)?

If a hacker can transmit a strong enough signal, "your" signal will be noise to the receiver. The signal strength may be enough to drive the satellite receiver into clipping.I can't tell if this will be the case without knowing something about your modulation and receiver, and I wouldn't do them in public in any case.

A satellite dish is not mandatory. Lack of a parabolic mirror will just mean a larger amplifier. A simple dipole is perfectly ok, provided you don't mind the whole world being able to see where you are, and running the risk of getting malformed children at some time in the future.

2. How many of you think that you could decipher the structure of the command (given the motivation)?

Why would I need to? You said yourself that I could snoop on your control signal to find the frequency. I will also need to find the modulation, and then I will have access to the signal itself. Have you seen any cars parked near any of the side/backlobes of your dish lately?

Ok, now for my scenario: What if some absolute bastard readjusts the orbit of your satellite, using your satellite to crash into another. If this is done in a certain way, the whole geostationary orbit could become littered with debris, with no feasible way of clearing up the clutter. Calculating these adjustments is a matter of applying sophomore-level physics.

Are anyone insane enough to do this? Are people insane enough to run an airliner into a building full of people? Who will get taken for everything they have got if their satellite destroys the geostationary orbit, and a postfact inquiry reveals that no security measures were in place?

Obscurity doesn�t work if you publish ...

[Anonymous Coward]

Your security holes on a website. I suggest keeping this kind of info to yourself. You're on the internet, finding out who you are and where you work is easy these days. By asking such a foolish question on a website you may be advertising for hackers. (are you?)

Further, if your employer's satellites are hacked, you're asking to be on the wrong end of a liable suit.

Good Luck!

Insider attacks

[Derek]

It sounds like you are extremely vulnerable to insider attacks or insider leaks. The information you posted in you question is probably more than you should have let out. Given a very motivated person, anything you do will be at risk. It is all about risk management. Good luck and ENCRYPT you signals for crying out loud!!!

-Derek

use IP

[Marauder2]

You probably want to talk to the OMNI group (Operating Missions as Nodes on the Internet) (IP in Space). They have done significant work dealing with using IP to communicate with the spacecraft, including issues of security.

I have passed this article onto them.

http://ipinspace.gsfc.nasa.gov/

--
Chris Hendrickson
FlightLinux
http://flightlinux.gsfc.nasa.gov/

All the ground-based security is well and good...

[-=OmegaMan=-]

... but if someone has local access to the satellite, watch out!

;-p

Access to transmitters

[Asic Eng]

The statement most crackers don't have access to a huge radio antenna with which to transmit relies on the applicable transmitters (all of them) to be secured properly.

I would have assumed that's the case, but then I'd have assumed that control links to satellites would use a secure protocol, too...

Also, if you want to defend yourself against rogue states, you can't count on them not being able to build a suitable transmitter. As we've all learned recently, some terrorists have very considerable resources to command, too.

Hmmm... not a bad way to start the year off.

[Proteus Child]

.Can someone effectively execute a DOS attack by uplinking to the satellite with a powerful signal... thus preventing us from commanding it?

I don't see why not.. as you said, if someone were to find out what frequency you transmit on (though they'd almost have to be within spitting distance of your C&C installation to do so), jamming would be easy. They'd just need to figure out what kind of power you were putting behind the C&C signal and trump it somehow. The exact mechanics of this are beyond me, though..

.How many of you think that you could decipher the structure of the command (given the motivation)?

I'm going to assume that you mean the lexicon of valid commands as well as the options and arguments to said commands here.

Assuming a motivation of "I'm bored..."? Most of Slashdot's readers. All it would take is time to map out which commands are valid and which aren't. Once you've got that, you just need to play with each one to see what it accepts. The major factor (once you've got access to the satellite) is time. If only for the intellectual challenge/bragging rights it would be done given the chance.

In response to your overall question of whether or not it would be worth the time to crack said satellite, I think quite a few people would give it a shot just to see if they could do it, so yes, it would be. The rewards if/when it's all said and done would be knowledge of that satellite's control systems and maybe bragging rights, but sometimes that's all you need to want to do it.

The most likely attack may not be technical

[Phil Wherry]

I'll let others speak to the technical issues about the difficulty/cost of sending rogue command messages to a scientific satellite.

I would note, however, that the simplest attack on a system like this (unencrypted or reliant on fixed keys) involves social engineering or the outright corruption of staff who know the details of the protocol and command structure. Do you think there's a chance someone who understands how to command the satellite might part with the information for $100,000? How about $50K? $25K? In any of these cases, the engineering effort required to reverse-engineer the information is likely to be lots more time-consuming and costly than simply bribing someone to give you the information you want.

When you're just trying to guard against the '7337 hax0rs working from home, you can pretty much focus your attention on technical avenues of attack and maybe some basic social engineering, but when considering a determined and well-funded adversary, it's important to take (management buzzword alert!) an integrated, enterprise-wide view of the problem.

hmm

[Anonymous Coward]

did work a bit in this field

basically, if they want to wreck a bird for the fun of it, throwing rocks at your antenna is probably the simplest way to go about it.

as for actually uplinking, they could cause you a lot of hassle just by filling the channel with noise, disrupting your commands

the cost of a bird and it's launch is much much more than the cost of causing you hassle

Re:I assume the run of the mill reply to this is..

[Anonymous Coward]

Do you feel better knowing that you wasted about two minutes of your life replying to, what was in fact, irony on your own joke?

Who is he asking anyway?

[Anonymous Coward]

I mean by his own admission the vast majority of people do not have the abilty or technical expertise required to operate a satilite. What advice could he hope to get on slashdot but a bunch of half assed guesses by people whom have no experiance in this field? The hardware on the bird alone will probably rule out most of the sugestions that will be made here. Not to mention the fact that he didn't mention if the data had to be decoded in near real time etc, etc.

Ahh, well I'm not going to debate this any longer
because no one will ever see this post. Plus I'm drunk and tired and my bed is beconing to me.

P.S One final thought: Why is this story listed under spam?

Re:I assume the run of the mill reply to this is..

[Asic Eng]

Well, having code up for public review will only do you good, if you have a decent security design as a starting point. If you already know, that all which protects you, is an obscure command set, then you won't get anything new out of this review.

Anyway, there are plenty of secure protocols available, you could take one of them (or even an implementation of them) and use it on your link. You could even review the code, to make sure there are no implementation errors, and should you find a bug you might even *gasp* give back to the community, and submit a patch.

Which would have the benefit that you'd stay in sync with the other people's code, and will probably at least give you a review of the patch.

Do a Bruce Schneier "Attack Tree" analysis

[aphor]

Attack Trees are a documentation system to identify security priorities, by Bruce Schneier of Counterpane Security and general computer security lore.

Theoretical attack on your satellites' controls:

1. Get a Mac Titanium book, and learn how to program the altivec DSP so you can use it to analyse the RF communications.
2. Find the command center by using the institutional addresses and scouting for the fabled high-power antennae, or just look for the characteristic antennae.
3. Use some RF equipment to "snoop" the band near the antennae and compare that to the RF band signal levels on the other side of a nearby hill in order to determine the antennae's transmitter band(s).
4. Snoop the most interesting channels on the suspected antennae's band. Correlate the suspected command packet transmissions with likely distant signals that return just after the minimum delay to geosynchronous orbit (about 600ms).
5. More snooping to find all the possible forward/reverse communication frequencies/channels of the command center. Save some RF snoops on your big 40GB hard drive.
6. Figure out the signalling used on the interesting channels. The forward and reverse channels are likely to have the same signalling.
7. Once you have the signalling down, figure out the transmission (packet) format.
8. Write yourself a packet decoder, and make sure you can tweak it when you find out new stuff.
9. Start analysing the packets' payloads for protocol. Since security is light here, you are roundig third base at this point.
10. Construct yourself a bigger antenna array and some transmitter/reciever equipment.
11. Take your equipment out into the field and test it out :)

BAM! In no time, you will have your own secret satellite command center!

Now, with that in mind, think about how you can make each step of this theoretical attack easier/harder. Go read that Attack Tree paper and make a draft-doc for your boss.

I would consider this a high risk regardless

[Skapare]

physical security (access to the control center)

Just how secure is it? Are we talking bunker fortress or a couple of hire-a-guards? Are procedures in place to make sure that facilities can be made non-functional in the case of an invasion?

network security (we use closed networks)

So no one has access to the internet from anywhere in the facility?

technology (most crackers don't have access to a huge radio antenna with which to transmit)

Most? Remember Captain Midnight? You're depending on the security not of your facility, but every facility under or near your footprint (which is most everywhere for non-sync satellites). You actually don't need that much power to communicate with a satellite. You do if there is someone else competing. And if the facility is not monitoring it 24x7x365, someone could take control when you are not looking, and you would not be there to grab it back.

obscurity (each satellite has its own command structure, not publicly documented

Certain high security facilities do not allow employees to take any papers or media in or out that's not specifically approved by many levels of mnagament with procedures in place to handle it. Do you got to this extreme? Ever heard of "disgruntled employee"?

execute a DOS attack

It's a matter of degree. Are the commands checksummed against noise? How strongly? Personally for something as critical as a satellite, even a science satellite, I'd use something quite strong to checksum, like MD5 instead of CRC-32. Sure, it's argueably overkill to use MD5, but I would anyway.

Once someone has your frequency, if they have access to any unsecured facility, they can DOS you. And many ham radio ops have enough facility in their backyards. Then if they got the specs from the disgruntled employee, and enough power to keep you from grabbing it back, they can even 0wn it. Even greater danger exists if the commands include uploading new program code.

How many of you think that you could decipher the structure of the command (given the motivation)?

For a company I once worked for, I cracked a competitors file format (so we could convert the data to our format) which included a proprietary compression algorithm for which I had no docs. Considering that I would not feel the multi-million dollar loss if command experiments dunked the satellite into the ocean (or worse), if motivated, and had access to doing occaisional commands on the thing, as well as sniffing the command upstream from nearby the uplink in one of the side lobes, I might be able to figure out enough to ... perhaps at least dunk it.

Standards being developed (like SCPS) intend to make satellites 'just another node on the Internet.'

My greatest worry with a lot of these generalized security protocols is not the crypto they provide (IPSEC is plenty solid enough in that area for me), but rather, in the social interface aspects ... the way things get routinely configured after the design is all done, by people who never designed anything secure, is the biggest risk I see. And, IMHO, IPSEC is rather exposed in that area due to the complexity of configuring its setup. Most security is.

I'm not looking for the Slashdot population to do my research -- I mostly want opinions on whether cracking a science satellite would be worth the time."

Steering a satellite over to hit something like an international space station would seem to be highly unlikely, given the small object sizes and the even larger spatial dimensionals up there. However, the cost of the risk is extremely high. Even so much as having a satellite out of control doing unknown things up there could cause operational impacts, and require aborting missions.

Whatever you design now will be used for how many years? And what will the new security requirements be then? Personally, I would consider every security risk at least in terms of the high cost of impact, and quite likely pretend a high chance of intrusion by a motivated cracker/terrorist. IMHO, it is best to maximize the security everywhere that you can't prove has no risk. And if you have not done so already, take an NRA gun safety class. Then translate the multiple layers of safety you learn there into multiple layers of security, and think like that everywhere.

Silly question.

[Restil]

You're asking a group of hackers... if doing something for the sake of doing it... "would be worth the time?"

You're askign a group of crackers... if performing the ultimate crack, obtaining command control of a satellite... "would be worth the time?"

As you said, the only reason it probably doesn't happen very often is a simple lack of the required tools. To hack into a system on the internet, you wouldn't need much more than an ascii terminal with an internet connection. To hack a satellite, you need some powerful equipment, and the average person who is able to afford such equipment, probably would recognize that the effort isn't worth the potential sacrifice.

Conventional networks were rather insecure in the beginning. But back then, the privilaged few who had access respected the system and didn't have the need or desire to exploit them. Times have changed, so much to the point that IF you are insecure, you WILL get exploited, and its only a matter of time? Satellites may begin to reflect this history soon. Right now, those able to access them have no need or desire to exploit them.

But just give it time.

-Restil

Obscurity never works....

[Anonymous Coward]

I hate to have to dissapoint, but the command and control structures of many common scientific and commercial satellites have been known and talked about openly in certainly communuities for many long years. Back in the bbs days there were specific sites one could go to that had complete information for command and control sequences for a number of satellites, what frequencies to use, etc. Of course, access to appropriate transmission equipment and the willingness to use it was the only real obstacle otherwise those satellites would have been hacked as much as the phone network long ago.

Security thru obscurity not only failed completely here long ago, but those that needed to most know of this vulnerability did not because they failed to take a proactive approach to this very real problem and so believed in their own imaginary security as appearently this person does to this day. This is the final and fatel flaw in any security thru obscurity regime, that those poor saps believe their secret really is secure because they have nothing to tell them otherwise until the day they are surprised like the emporer who has no clothes.

Obscurity IS security.

[Anonymous Coward]

After all, passwords qualify as security by obscurity.

Depends on satellite

[tanveer1979]

As for ur question, wether someone would like to crack a science satellite, it depends upon what the satellite does.
If it can give access to the person about a regions weather, landscape.. or it is a remote sensing satellite then yup, some rogue nation would definately be interested.
Moreover this can be done for ransom purposes, a lot of money goes into a satellite, the person may ask a ransom of about 10% of the satellite cost, but not to worry in that regard, u need a real rich hacker.
The biggest danger is that the person may be actually trying a military satellite and uses an ordinary one for dress rehersal.
Lots of possibilities here.. and i agree with slashdot, obscurity is not security. I am not very well versed with satellite protocols, but i think the wireless enginners must be having ideas about security in such situations.
The best way is to encrypt everything and use frequency hopping over a narrow range using an encrypted key. This method can be useful for sensitive places.

Cheap karma-whoring link

[Platinum Dragon]

Captain Midnight!

It's not just a nice "satellite takeover" story, it's also a great "fight the Man!" tale.

I personally wonder if someone could do a Captain-Midnight job on an MTV transponder and send the message "PLAY SOME DAMN MUSIC SOMETIME, LIKE THAT MUCHMUSIC CHANNEL IN CANADA!" Or a CNN /FoxNewsChannel/MSNBC transponder - "HTTP://INDYMEDIA.ORG - REUTERS AND AP ARE NOT INDEPENDENT MEDIA!"

A man can dream...

Don't worry about the small time crackers

[Anonymous Coward]

Assume the unknowns are ten guys with a budget. If you can keep them out, then the small crackers are no problem.

Undocumented command structure? It's just a weak form of encryption, crackable with time and data. Look up code (not cypher) breaking, basicly the oppositions just matched up what was sent with the satallites behaviour. Denial of service attack? As others have noted, all they have to do is lock out your signal with a stronger one. By the way, what's the implication of the satallite getting a command carrier for 48 hours? 72 hours? Does it automatically transmit back, and how long can it keep it up?

Off-Topic: good .sig

[aphor]

I just wanted to say that your sig qualifies as poetry. When I read it and thought "WTF?" I started coming up with all these completely hilarious explanations --granted though, all in geekish dialect. Congratulations for having high-density humor!

I hope you enjoyed your job...

[Palin Majere]

I mean, seriously. If you do work in "the satellite control industry" (that's a seperate industry from the satellite industry?) and are doing the work you claim to be, then you have several problems:

a) You should already know the answers to questions 1 and 2, and have enough of an understanding of 3 that removes the need to ask it. You should also already know, based on 1 1/2+ years here on the site, that this is *hardly* the forum for a real answer to that question.

b) You just divulged some fairly major security-vulnerability information on the internet equivelent of Prime Time television.

c) I would hope that nobody at your company gets wind of this posting, because it would not take a rocket scientist (*smirk*) to figure out who you are.

I'm really not trying to flame here, but this *really* seems like a horrible, horrible idea. From a security standpoint, if your systems are based on security through obscurity, the *last* thing you want is more attention being drawn to them, especially if the amount of attention being given to the subject matter is by nature usually small (how many people have satellite transmitters?) and prone to mass speculation (how many openly documented satellites are there?). Just by asking this on Slashdot, you've brought more attention on satellite-hacking as a whole, thereby astronomically increasing the chance that someone takes a more "active" interest in figuring out how to send your company's prized birds into a flaming death spiral.

Of course, all this assumes you are what you claim to be. You could very well be (as another poster suggested) a cleverly disguised troll.

I mean, geez. Shame on you for submitting, and shame on Cliff for posting it. Doesn't the /. crew think 5 minutes on a submitted article before posting?

(Moderators, feel free to mod this appropriately. I have more than enough Karma, thank you)

Re:I hope you enjoyed your job...

[Coz]

Heh. Actually, the satellite control industry (Integral Systems, Harris) does exist separate from the satellite construction industry (Boeing, Loral, Ball, Spectrum, and that's just some in the US), and you can now hire PanAmSat or Honeywell (the old Allied Signal group) to control your satellite for you once you've launched it.

How many people have satellite transmitters? Well, how many people have DirecTV? EchoStar? Even better, DirectDuo or DirectPC? Those receive and transmit to the satellites - not, of course, using the command-and-control paths. Transmitting to a sat is simple.

How many openly documented satellites are there? Hundreds - most of NASA's satellite documentation can be retrieved through FOIA requests, if not through academic queries or Web searches. You can learn an awful lot about commercial sats just from the vendors' web sites (like whether they have in-band control, and the frequencies used for C&C for different birds).

All that aside, it's been an interesting thread - well worth the posting, even if a bit uninformed in premise.

Re:I hope you enjoyed your job...

[Palin Majere]

See? I learn something new every day. :)

Satellites aren't my forte, but I think the flaws in this article were pretty blatant even to the uninitiated. I know *I* would be out of my job if I posted something like this about the servers where I work (which, btw, *are* secured and use encryption, thank you), and I don't work with multi-million dollar orbiting devices...

Re:I hope you enjoyed your job...

[Coz]

Agreed, mostly. I _do_ work with multi-million-dollar orbiting devices, and my career expectancy (in this area, at least) would be shortened by something like that post.... :/

Re:I hope you enjoyed your job...

[teridon]

a) You should already know the answers to questions 1 and 2, and have enough of an understanding of 3 that removes the need to ask it. You should also already know, based on 1 1/2+ years here on the site, that this is *hardly* the forum for a real answer to that question.

Did I say I didn't know the answers? ;-) My research philosophy is get as many sources as possible. I figured on a 1% S/N ratio on the replies -- and there have been some good points brought up here that I did not think of myself.

b) You just divulged some fairly major security-vulnerability information on the internet equivelent of Prime Time television.

True, perhaps. Though I'd argue that people who cared, already knew.

c) I would hope that nobody at your company gets wind of this posting, because it would not take a rocket scientist (*smirk*) to figure out who you are.

I've already done my research/presentation to the company, and it was well received by both management and customers. I'm secure in my job.

Just by asking this on Slashdot, you've brought more attention on satellite-hacking as a whole, thereby astronomically increasing the chance that someone takes a more "active" interest in figuring out how to send your company's prized birds into a flaming death spiral.

Yes, that would suck. Shame on me. I guessed (incorrectly) that it would not be a popular thread.

Thanks for your thoughtful response.

Re:I hope you enjoyed your job...

[Anonymous Coward]

small dish transmitters? ...Really?

/me stops winding helical antenna

Re:I hope you enjoyed your job...

[Coz]

I hope you've enjoyed the variety of responses. From what I've read, they range from crackpot (usually pretty obvious) to predictable (run Linux and ssh!) to funny (more of those than I thought) to informative. It has been fun reading. Hope things go well for you - good luck with the bird.

Re:I hope you enjoyed your job...

[philthechill]

You should read the book Security Engineering by Ross Anderson. I am in the Network Security business, but this book covers all kinds of aspects of security. Interestingly, it is all about looking at different systems and attacks, even Identify Friend or Foe systems from the military, but about a week after reading it everything seems to click together and you start to understand about how to go about engineering secure systems. There are two main points to the book. One is that systems change, their requirements change over time as they become used by more people, but often the security component does not evolve with the system. That is one source of problems. The other is that where systems interact and interface, you are likely to have security problems. Anyhow, this book spans the gamut from banks and accounting security to nuclear security, and I highly recommend it.

Phil

Re:I assume the run of the mill reply to this is..

[Anonymous Coward]

You have got to be kidding. Keep your code locked up and don't give it to anyone unless they have a need to know. Opening code is the stupidest thing you could do. It's kind of like publishing hacking exploits before the patch is released - someone will use it against you. You don't need these yahoos to review your code.

Security through obscurity is essential

[Theo DeRaadt]

I often read here on Slashdot that security through obscurity is no security at all. This is just another convenient mantra that people like to parade around when they want other people to think that they know something. The truth is that obscurity is an essential part of any electronic security scheme.

The most obvious example of this principle is in encryption. In both public- and private-key schemes, it is essential that you obscure your keys (or private keys) from view in order to maintain secure communications. It works the same way with other methods, such as keeping the command structure of a sattelite secret. If no one knows the command structure, they might as well be brute forcing an encrypted message, because a command could be just about any length to be valid.

So really, people here should be very careful when speaking in absolutes. It doesn't work when comparing the performance of operating systems, and it certainly doesn't work here.

Re:Forget reverse engineering -- who's quit lately

[Anonymous Coward]

OK, any good looking female hackers or spies or whatever mail me at snowiscold2002@yahoo.com

Back to topic.
I'd hack all weather satellites to get rid of all those rain forecasts :-)
I'd hack a tv sat get it to send UN-encrypted TV (prolly has nothing to do with the sat, but hey ;-) )
I'd hack a spy sat (or anything with a powerfull cam) to peek at nude beaches etc. (I still want to see a picture of earth made by Hubble...)
I'd hack some telco sats for the bandwidth (thoug the delay is prolly no good for online games :( )

HOW would I hack them?
The freq should be no problem to get. Look at the local freqency plan (public record) mayby even the licenses are public record in your country.
Direct access to the dish is prolly secured, but shooting a line of some sort might go unnoticed for a very long time. When was the last time you physicalle went out there on the lawn to check the dish? (Hey I'll get a temp job as lawnmower!)
I currently am aware of two dishes laying around that might be suitable. My old school has a 18' dish turned updide down occupying part of the lawn. I think that if I tell the principal i can take it of his lawn hell give me some money to do it :-). Then i now another smaller one lying right next to a road. I guess it belongs to the telco there, but they are into cable now. A truck with a hook is enough to get at it...
The feeder on the other hand will be another problem... I'll try google or wer-liefert-was to order something online through a post box company.
Next step: start sniffin! (using the dish for the downlink and the cable shot into the "official" dish for the uplink)

Your professor said to do your own homework

[owlmeat]

You can't possibly be working in the industry and posing this kind of question to slashdot.

Security Issues

[batboy78]

I used to do support for a satellite system at Schriever Air Force Base. Since all the systems were housed inside sealed 'mods', and the systems themselves where all stand alone, with no circuits to the internet or even siprnet. They take security there very seriously, one time I had three failed access attempts to the 'mod' I was trying to gain access to, and armed guards came around the corner at double time, and put me against the wall like a common criminal. Now thats securtiy.

Dear Tendron

[OSgod]

We are herewith terminating our employment agreement with you. We hope that the officers who execute the warrant issued for your arrest take the time to rough you up on the way in.

This kind of abuse of our intellectual property is inexcusable. To share a critical security issue on a public bulletin board with a group of aging hackers and hacker want-a-be's goes beyond lack of knowledge to the land of criminal intent.

Exposing holes to the world is not your job. Exposing them internally may be. In no event do you have the right or responsibility to expose those holes to any segement of the public. Regardless of corporate policy on security through obscurity you have probably committed more than one crime by publishing any hint that a security hole may exist.

profiling

[Anonymous Coward]

Every hacker that live on earth needs to be profiled. Use trojan software and spy camera on the hackers. Anyone who use computer at cybercafe need to provide identification. They cannot stay anonymous.

Re:I assume the run of the mill reply to this is..

[liquidsin]

yes. yes I do.

Security: Obscurity and Openness.

[hateddamntruth]

Obscurity is some kind of security, but only as long as it stays closed.

But the security is far better if it uses encryption that remains open, and yet unbroken.

Sniff the connection?

[MobyDisk]

I assume it would be really easy to sniff the downlink, but is it also possible to sniff the uplink? If so, then someone can figure out the command structure once they decrypt the signal.

What about pre-programming the satellite to change encryption keys on a schedule or something? What does 802.11 do to generate new keys in a secretive way?

Re:Sniff the connection?

[Ranger Rick]

Is 802.11 really a good example to use when discussing securing something? Well, except maybe as a counter-example... =)

Re:I assume the run of the mill reply to this is..

[Asic Eng]

Assuming you haven't managed to implement *any* security, you'd probably be better of, using someone else's system, no?

No you don't need to post *your* code and say "hey look at this, if you find the hole in it, you can break my satellite". You can however use a proven technology to secure your link, and yes, for that to be proven it needs to be open.

You can still have your obscurity - you don't need to tell anyone which protocol you are using, even your command structure can stay just as secret as it was before - it's on another protocol layer.

If you were to use (random example) ipsec, and send your SATCOM (made up) protocol over that, and then someone finds a hole in ipsec. Well then you are just as secure, as you are now - the attacker still needs to break SATCOM, as well.

DoS requires line of sight

[igaborf]

One thing you didn't make clear was whether the satellites in question are geostationary or low-earth orbit (LEO). I'm guessing it's the latter since most scientific satellites get little benefit from geostationary positioning. (Which is dramatically more expensive than LEO and puts your earth sensors -- if that's what you're using -- farther away from the earth's surface.)

If they're LEO, there will be periods of time during which you will be line-of-sight to the satellites but the attacker will not -- unless the attacker is either at your location or has multiple uplink sites. Even if the attacker has a strong transmitter and can DoS you while he sees the satellite, once he's out of the footprint of the bird and you are in it, you'll be able to command it.

Motivation

[Captoo]

Whenever you have something that's valuable to you, you should protect it as if it is at least as valuable to someone else. I'm sure that there are plenty of people out there who would love to take control of a satelite. Some people would only want to log in. Some people would want to snoop all of your data. Some people would want to take control of the satellite away from you. I bet that there are even some people who would love to change the orbit so that they could see a fireball from their back yard. Why would people want to do these things? For the same reasons that people indulge in shoplifting, vandalism, espionage, fraud, etc. If enough people think that they can, someone will.

Smokescreen

[Technician]

Sometimes all it would take to mess up a satelite requires very little knowledge of the command structure. All that is needed is someone to capture station keeping packets and retransmit them at a later time. This hack has been used by thieves to shut off car alarms and open garrage doors. That is why rolling codes are now used on most car alarms and door openers. Overcorrection may put the satelite out of orbit and deplete the station keeping fuel.

Maybe as part of the obscurity is security protection, a jamming signal should be broadcast at the time commands are sent. The jammer would use a vertical dipole to provide bogus packets to sniffers while the high gain antenna reaches the satelite with the valid signal. The dish sidelobes could be easly hidden from sniffers. Has anyone thought of implimenting the jamming the sidelobes?? Any command should have a time code and rolling code included so any record and rebroadcast attack will not be accepted. For as much money that goes into the birds, innexpensive security could save a lot of insurance money.

Give this guy a break..

[jaseuk]

He never said he was in charge or responsible for anything. Just tasked with researching what the security risks are, presumably so those who are responsible can make informed decisions.

Jason.

Some Answers from a Sat Engr

[SatelliteBoy]

1. DOS attacks can be accomplished, based on the design of your bird. I do not know the particulars of your command reciever, but some designs can be DOSed.

2. It is entirely possible to reverse engineer the telemetry and command databases. I know a guy who used to do this to Soviet satellites for a living. They could control Soviet birds however they willed.

3. I'll let others with more knowlegde on IPSEC to give a specific reccomendation. I am leery of this concept, however, given the historical security of anything attached to the Net.

It's really all just a matter of motivations. People listen to satellite telemetry all the time. Many of them reverse engineer it. Some can get images from the weather birds, but never try to command. Expect some eavesdropping, unless the bird goes really far away and requires >5 meter dishes to get a usable signal.

And remember, the CIA managed to "borrow" a Soviet Luna probe on world tour. They disassembled it, documented the design, and rebuilt it to get it to the destination in a pretty serious all-nighter. The Soviets never gave any indication of knowing.

Oh, and remember - keep the arrays pointed at the Sun.

Re:Some Answers from a Sat Engr

[Coz]

That's arrays at the Sun, antennas at the Earth... and NOT the other way around.

Pointing a directional receiver at the biggest RF source around is not good for the electronics, nosirree....

It's not just the data

[clark625]

One thing the submitter failed to say was which type of orbit the satellite in question has obtained. This can make a huge difference. If it's a geosynchronous orbit, you know exactly where your satellite is at all times and (hopefully) you can also point it's dish right back at you. You would want to prevent people from snooping your signal in the first place. People can't reverse engineer a signal that can't be perceived from a convenient location.

My guess, though, is that this particular satellite isn't in such an easy orbit. That's fine, but extra measures should be considered. One neat trick if you're designing a satellite is have the longest wavelength as possible. That makes it very hard to intercept communications (even though they go everywhere, even deep in the ocean). The U.S. Naval command sends messages to submerged submarines using a wavelength on the order of 2 meters. If a really large dish is required just to talk to the satellite in orbit, someone is gonna notice when a guy builds a replica in his back yard.

Okay, that's all for initial designs. Here's what I suggest as something you can change now, without much fuss. Forget about encryption nearly entirely. I'm guessing that the satellite does have a clock (and ideally it sets itself to the GPS signals). Now, the satellite should only obey signals that arrive between pre-set times (though it can behave as though it's really going to act, as a foil attempt). Second, the ground station should send commands followed by a signature--like PGP signatures. The satellite's software should easily be able to confirm that the message is authentic. No need to encrypt--since no one else can reproduce the signature. If the signature is valid, the orders are carried out. If the signature is bogus, the command is logged and relayed back to ground later for inspection.

DOS attacks are more difficult to deal with. My personal feeling, though, is that if this particular satellite must have updates every day or so, you're in trouble anyways. Perhaps you can find a way to ensure about 3 days worth of commands can be in queue, in the event that the satellite is unreachable. That will keep it roughly in its orbit. Then, if a DOS attack does come, you'll have those three days to track the source. That should be plenty of time. Also, and I could be wrong, but most "hackers" or whatever prefer a much more immediate result. They would want to do the DOS attack, see the satellite go down in flames or whatever. Waiting 3 days for something to happen... all the while being searched out... is likely to make the hackers very, very scared. I would be shocked if they transmit more than a day, personally.

Re:I assume the run of the mill reply to this is..

[Ars-Fartsica]

You could even review the code, to make sure there are no implementation errors, and should you find a bug you might even *gasp* give back to the community, and submit a patch.

Yes, the community of open-source satellite operators will be grateful indeed.

Is your satellite steered by an SSME or Energia?

[leonbrooks]

but imagine the consequences

With thrusters that can put out about as much as you could fart, only for maybe a few hours tops before they died, you needn't lose any sleep over the prospect of being bopped on the nose by the great-grandson of TIROS I.

Even if you had perfect control over a sat, steering it to do as much as dinging another sat would be like playing billiards on Kennedy Field, starting in opposite corners; or perhaps like blindfolding yourself and trying to pick up the same grain of sand from a beach, by itself, twice running.

To get yourself hijacked, you'd need to hit some turkey on the fine line between smart enough to break it, and dumb enough to think you can drive it like Zidgel from the 3-2-1-Penguins videos does his ship (hint: it's a manual withthree-on-the-tree shift).

``What happened? Did the landing gear fall off or something?'' (-:

Security through Obscenity

[trongey]

If you transmit enough jiggly pix in your data stream then the script kiddies will forget what they were trying to do.

Not that big of an antenna...

[AmigaAvenger]

Just for everyone's information, I talk to different satellites on a regular basis using nothing more than a mobile (car mounted) radio and antenna that is less than 6 feet in length. (~60 watts transmitting on 2 meter/70 cm frequencies) (AO 27 and Oscar 14) You do NOT need a huge antenna, but this depends entirely on the satellite. Think 2 way internet via satellite...

Re:Not that big of an antenna...

[dbateman]

There are typically many antennas on a satellite. You are probably talking to a relatively high gain antenna if you are only using a 6ft antenna. The command antenna has to work even when the satellite is in a spin our of control so that there is some hope of recovering it. Thus the command antenna on a satellite is typically omni-directional and thus you'll need higher gain on the ground (bigger antenna) to talk to it.

D.

Re:I assume the run of the mill reply to this is..

[Asic Eng]

I'm sorry, but are you *trying* to miss the point? Encrypting the control link to a satelite is not specific to satelites in any way, it's just another application of encryption. The only part where it becomes satelite-specific is on the payload level of the protocol. Ideally you'd not tell anyone about *that*.

obscurity is not security, but..

[siphoncolder]

one of the common mantras on /. is that security through obscurity is NOT security.

however, neither is encryption.

encryption and obscurity are MEASURES towards providing the illusion of security.

obscurity is a measure that says "as long as they don't sense this or think of it, we're ok."

encryption is a measure that says "as long as they don't crack this, we're ok."

neither is secure, but both together ARE decent measures, if you combine them right, kinda like front lines in a battle. have an invisibility shield (obscurity), but if that fails, have opaque defenses that are hard to break (encryption).

obscurity means you lose a level of trust with those inside the company - encryption means you lose a level of trust with the outside world.

The GPS Sats were hacked a couple years ago...

[mplex]

The guy who started eEye was originally busted for breaking in to the computers that controlled the GPS sats. I saw it on the MTV hacker special, and besides, I used to know the guy.

Re:May have military use...Already done it

[K7001]

you may remember back in the 90's when challenger
went down and the US space program was set back to no more shuttle launches.
meaning their spy satelite programs fell way behind the soviets. well just so happens that some old weather satellites changed their orbits ..... right into the russian spy satellites
sorry guys already been done. I could post proof but then i'd have to tell you where it came from and then get shot by MI5 or someone

Satellite security

[SwedishChef]

IS THERE A RISK OF DOS?

Yes, absolutely! Ham radio operators have done moonbounce and many of them routinely communicate via satellite (transmitting to a satellite and receiving signals from someone else transmitting to a satellite - "hamsat"). There are also RF amplifier designs that would surely overwhelm (or at least degrade) your signals. Anyone with technical knowledge of RF and some skills at putting a system together could DOS you. Of course, these signals could be traced so that the DOS could not last very long without serious risk to the perpetrator.

IS THERE A RISK OF DECIPHERING COMMAND CODES?

Again, yes. In order to decipher these codes all a one has to do is locate in the vicinity of your physical command center, buy (or build) a receiver capable of detecting the frequencies you use, and put up an antenna (under the guise of amateur radio if necessary). Now they can sniff your uplink and downlink. Once you have access to both of these it's only a matter of time and intelligence before they determine your data structure.

IS PHYSICAL SECURITY ENOUGH?

No. Information within a company can be likened to a conspiracy and no conspiracy is ever safe. Someone, at some time, will see their own self-interest as higher priority than the group's interest. A perfect example of this is CIA's Project Jennifer (the Hughes Glomar Explorer). The newsworthiness of the project overwhelmed some of the participants with a sense of their own self-interest and they told news agencies.

Someone at your facility has probably already told someone else NOT at your facility enough details to allow them to do your system harm, if they wished.

SHOULD THIS INFORMATION BE ENCRYPTED?

Yes, absolutely! What's more, it should be encrypted under a method that will allow the key to be changed on a regular basis.

Given the expense of losing control of a satellite, the costs of security would be a pittance in comparison. Given what you've told us about the signals security at your facility, I imagine that the physical security and network security (does anyone have a modem in their desktop so they can work from home?) is likewise not very good. I would recommend a thorough analysis of all of these.

Re:I assume the run of the mill reply to this is..

[posmon]

and indeed to image a beowulf cluster of the fuckers.

RE: DOS attack on sattelite...Quick answer YES.

[SacredNaCl]

In radio there are two main things which determine who will win in a contest of signals, they are: Line of sight, and wattage. If the person attempting to stomp on your signal has equal line of site, and superior wattage, yes, he will stomp all over your signal. You might be protected from regions of the world which don't have line of sight to your sattelite, but anyone else... The only good news I have for you is, it's not terribly difficult to triangulate and track down a radio signal if the event were to happen for a sustained period. The problem would be, he could be anywhere that has line of sight. If it ever happens, definitely call the FCC and get manpower, you'll need it.

Transmitter not a barrier to entry...

[joshamania]

Well, I certainly don't think the transmission gear is a barrier to entry. You can most certainly communicate with a satellite with a 100W amplifier and perhaps an 8 foot dish (+45db gain). Mebbe even smaller, it's been years since I've touched the stuff. In fact, I'm sure smaller, but perhaps you'd need a higher power amplifier.

When in the service, we'd regularly use an 8 foot dish (about 45db gain) and transmit anwhere from 5 to 20 watts. You might be able to jam a scientific satellite with a strong signal, but the military jobbers (and prolly the commercial comm sats too) have multi-horned directional antennaes, so the operator can shut off signals from a certain part of the "ground", say, California, but still be able to talk to the rest of it's line of sight.

Anyways, you can get commercial gear for less than $10,000 USD that would give you the capability to communicate with a great many satellites.

Think of it in terms of physical security

[stienman]

Think of it in terms of physical security. You wouldn't leave your office unlocked just because you thought no one knew where the entrance was, or knew how to operate your special door handle which required no key.

Your uplink is publicly accessable, and therefore should require some sort of key. The strength of the lock should be determined by the ratio between needed security and money available for the lock. Sure, it'll cost a few k in development costs to put a better lock on, but think about the money lost if the satellite drifted under the control of a hacker, and you didn't have the fuel to put it back.

Of course. telling a group like this that your satellites are largely unprotected is like telling a kid the candy store is unlocked and no one is watching.

The other issue is that your customers likely have insurance on the sats. It may be that a good encryption system will lower the insurance cost, and thus make your sats more valuable when people start hacking into them.

-Adam

thats too far.

[geekoid]

Maybe I missed the point of this 'article' but he seems to anwer his own question when he states the military's solution.
Physical security is very important in order to stop someone from screwing with your bird, and what he laid out seems good, as long as the people supporting it adhere to its design.
If you are broad casting data from a satalite, anyone can pick it up. If it's encrypted, then it becomes difficut to trans lates that data into something meaningful, but people can still recieve it, it is just a radio signal.

Glory

[geekoid]

Can you imagin the fame that a hacker group wold get if they changed the orbit of any bird?
It would be huge. That alone would be enough for some people, who would do it regardless of laws.
As far as your data is concerened, if this company makes money from the data, then encrypt it otherwise someone else will take it and sell it to whom ever your selling it to, but if it is JUST for research, I say don't encrypt and tell every one where they con point there personal dish to recieve it. The more peope, that receive scientific data, the more likely someone will find something usefull.

It's not so easy

[McCarr]

I was a payload systems engineer for a major manufacturer of commercial communications satellites (now retired). All our birds had encrypted command links: DES for export or an NSA chip for domestic users. The command link was very narrow band and had a low data rate - everything happens in slow motion in orbit. The uplinks typically used a KW klystron and a 30' dish so jamming or DoS is difficult and would just about have to be an inside job at an earth station or a hostile government. We would never use an internet connection. If commands were sent from off site we would use dedicated phone lines. For launch ops we would set up two leased lines and a dialup.
There was one incident in the early 90s when "Capt. Midnight" broke into a TV channel with a rude message. That was an inside job, but I don't remember if he was caught. It did scare one customer into specifing an elaborate "intruder detection and elimination system" where the birds antenna pattern could be changed to put a null on the intruder.
All I can recommend is to use encryption - it's not that hard, and stay off the internet.

Re:It's not so easy

[McCarr]

An addendum: The command sequence was as follows:

1. send a command (100b/s or 1Kb/s).
2. S/C telemetry responds repeating the command.
3. send execute command if 2 matches 1.
4. telemetry stream reports the results of the command.
All the above encrypted.

The owner would know in short order if the command was bogus and could take corrective action. It would be unlikely that a random command would have a disastrous effect.

Command Replay

[metoc]

Reverse engineering of your command structure is not necessary unless someone wants real control of the satellite. The ability to record and playback commands is probably enough to do some serious damage.

Satellite Command and Control Security

[ErikVonLiedtke]

1. Yes. As someone else has mentioned, satellite receivers link to the most powerful signal. Depending upon the orbit and radio frequency of your satellites, the transmitter may require anything from a simple dish to a huge tracking dish. For most purposes, an old C-band dish would suffice, but would require a transmitter. Tracking systems can be cobbled together from COTS parts, although there are gotchas.

2. How many of you think that you could decipher the structure of the command (given the motivation)?

Consider that a high school science teacher and class in England managed to capture and decode the downlink of the GLONASS (Soviet GPS) satellites. Your downlink is broadcast to anyone listening within the footprint of your satellites' transmitters. If that same someone listens to your uplink (more difficult but there are sidelobes), they can eventually learn your command set from the changes in telementry. BTW, recognizing telemetry is relatively easy. Satellites report on a standard set of characteristics (attitude, power, data) and can be easily understood.

3...Take a look at the security protocol (which is based on IPSEC, et. al) and tell me if you think it is secure, or whether you'd want to crack it.

I get paid for that. Without more time than I'm willing to

Sometimes its not so obscure

[Anonymous Coward]

About 3 years ago in a university library I accidentally stumbled upon a stack of documents that described in detail how to build your own receiver to downlink meterological maps from the GOES weather satellite(s). Don't remember if it contained any uplink info as I'm currently 3000 km away from that library :-(

Re:I loved the way that Cliff phrased that

[adrianhensler]

Yes, I had the very same thought. I think that the best way to get them to increase security would be to ditch a couple quarter billion dollar birds in the pacific. Or out the other way; either would have the same effect.

I think the very next day there would be some very frank discussions about security.

Re:I assume the run of the mill reply to this is..

[Anonymous Coward]

He wants to INCREASE security, not eliminate it. In addition, I assume that a satellite cannot be rebooted once per day so NT,2k,xp is out of the question.

Patching a satellite is very risky (what if it doesn't come back up, or blue screens after a patch?)

Since a mature version of linux/unix requires very little patching, and NT needs a patch a week almost... well you get the idea.

Security tips:

1. Write routines that check origination of communication against a known source list.
2. Use strong (A-Z a-z 0-9) alphanumeric passwords of at least 14 characters in length. Don't be afraid to use punctuation.
3. Use at least 128 Bit encryption for all communication. Ensure that the cryptographic keys are not only made in a secure (unpredictable) fashion, but that they don't get comprimised by prying eyes.

For more security tips look up www.securityfocus.com and other similar sites.

l8,
neilio

Re:May have military use...Already done it

[Anonymous Coward]

Uhm, Challenger went down in '86
Shuttle flights resumed in '88, not "back in the 90's"

The shuttle may carry occasional military payloads, but it has never been the preffered LV for these jobs.

Look at the record for weather satellites. No catastrophic failures in this time frame.

I don't have time to get into the astrodynamic & dV arguments.

And finally, I work in the field. It didn't happen. You are so FOS.

In orbit, everyone is equal

[Anonymous Coward]

If you really want to emphasize that security is extremely important, you might tell your company that, while command and control of commercial and military satellites are protected with strong encryption, the scientific birds are prime targets for the simple reason that they're already in orbit (which is the primary price of entry that prevents space havoc from being done by those who would do it). Now admittedly, you'd have to know a hell of a lot and have very good tracking and targeting, but if you wanted to take out a military/commercial bird, what better way than to do it with a scientific bird already in orbit? At a bare minimum, I know that control of satellites provides top bragging rights in the hacker community... the trick is how do you verify? Knocking something out (independantly verifiable, like PAS2 or some other TV signal repeater) or forcing the Intl. Space Station to move (recently reported in the press) are the only ways...

Technological barriers fall rapidly over time (and this includes encryption... I beleive the military birds are re-keyed regularly) and even minor nation-states (and even some of the more affluent US highschools) can, with a little gumption, overcome simple issues such as having access to a parabolic reflector of the right size and a tranceiver that uses the right frequenc{y,ies} and modulation.

Given the illustrious history of failure the scientific birds have, perhaps the lack of concern over command/control secuirty is well/mis- placed.

I'd be delighted to test for security.

[Anonymous Coward]

What's the IP?

2 meter signals to submerged submarines?

[SwedishChef]

I cannot imagine 2-meter wavelength being referred to as "very long". They may be using signals in the 140mHz range (VHF) to communicate with submarines but the signals are certainly not penetrating the deep ocean.

Last I heard (and it's been a while, I admit) the USN was communicating (one-way) to submerged submarines using a wavelength of about 6000 meters (50kHz) from a million-watt transmitter near Arlington, Washington (Jim Creek). This station was located in a valley in the foothills of the Cascade Mountains that faced WSW and the antennas were strung from one ridge across to the other.

When you drove up to the station you had to park with your bumper against a grounded barricade so that the car wouldn't act as a capacitor and build up a charge which would be discharged (through you!) when you tried to open your car door.

Re:the very fact that you told us how you already.

[Anonymous Coward]

... is a huge security breach. You just told us you don't use encryption and that to attempt communication you need a radio antenna. Some people do have access to radio antennas. Heck they aren't that hard to build yourself anyhow

He's not talking about a CB radio antenna...

He also hasn't told you what satellites, let alone where they are (ever have your DirecTV antenna misaimed by a half degree?), or what frequencies they use. Also, telling us he uses "radio" to communicate with his satellites provides approximately as much information as telling us that the signals are binary encoded.

examples of prior mistakes

[dks]

If you want concrete, real-world examples of how badly-designed (or nonexistent) security systems can fail, see Ross Anderson's book, Security Engineering.

The question to ask is not whether its possible/easy for someone to hack your satellite, it's can you afford it if they did? The answer to that would seem to be no. That means you cannot afford to not use the best protection available to you.

Get an experienced hand to support your effort...

[Samuel Nitzberg]

I would presume that any bird flying might be of -some- interest to a hacker, even if it were just flying around and transmitting a beep tone every second.

If your firm genuinely values this satellite, and if this satellite handles data of any value, I wouldn't play any games. If I lacked the in-house knowledge, I would hire a firm with significant satellite experience, e.g. those that have designed several or dozens of satellites, and bring one of them on board for their expertise. Securing this craft shouldn't be seen as a learning experience; any mistakes could be costly, and re-engineering solutions probably wouldn't be met well by senior management later.

If you were planning to build a satellite, I might start a general survey of security techniques, techniques as they apply to your special circumstances, prior to development. Since it is already up, I would get my hands on expert talent (not even just a consultant, but a firm with military satellite experience). Your firm would also learn what it might need for the next craft, and this would be very valuable.

Good luck...

Sam Nitzberg
http://www.iamsam.com
sam@iamsam.com

process, not product

[nor]

It's not enough to try and cover the security issues, then throw your hands in the air and say "We're helpless!" when someone circumvents your security. You need to develop contingency plans for when your security is compromised and one of your birds is attacked.

As mentioned by another poster, unless nobody ever leaves your company and nobody ever talks, you can be vulnerable even if the protocols are never published. It is difficult, but not impossible, to reverse-engineer these protocols. It may be easier with your birds than with the commercial communications satellites I'm familiar with, as the downlinked data is probably more tightly coupled to the operational scenario (i.e.: your commands to the spacecraft will be reflected in the data stream coming down, which probably isn't encrypted.) It's pretty hard to tell the effects of most maintenance commands from the ground unless you have a telemetry receiver, which are expensive, platform-specific, and hard to come by. And you still have to know the protocol to decode the telemetry.

You may have a closed network, but it only takes one moron with a notebook and a modem who forgets to disconnect from the intranet before dialing up their ISP to change that. Or someone with a compromised computer which is then connected to your intranet. *sniff* *sniff*

A DoS attack doesn't have to be deliberate to be effective. The gremlins can get you as well; e.g.: backup command center is offline as online command's HPA fails, and nobody can talk to the bird. You need to be able to deal with these types of outages as well.

The moral of this story: the security issues are simply additional operational scenarios to address, just like a communications, gyro, or power system failure. You try to prevent these as best as you can, but you also must plan on such problems occurring in spite of your best efforts, and be ready to address them. You won't be able to think of every one, but every one you address in advance improves your chances of being able to recover from the incident.

You may want to integrate security breaches into your procedures as another failure mode; e.g.: battery heater fails. Possible causes: (1) failure of heater element, (2) power bus overload; (3) disabled by unauthorized command. Some scenarios may lead to total mission failure. C'est la vie. At least, if you've thought of the scenario in advance, you have the advantage of forethought if and/or when the problem actually occurs.

Slashdot Resume Service

[Anonymous Coward]

I'm not looking for the Slashdot population to do my research

No, it seems from the idiocy of your questions that you're looking for a job. Who hired you at the current one, given that you seem to know nothing about it?

Need to Know & Personnel Reliability

[Anonymous Coward]

It isn't as easy to command a satellite as many people think. There are technical requirements that would make it difficult and expensive for J. Random Hacker.

Detailed command information should be restricted data. It should only be distributed to those with a need to know.

Engineering and operations personnel should have security clearances.

I would be more worried about unauthorized access to the computer systems and networks used to generate and relay commands to the ground stations for uplink. Why build a ground station when you can use an existing one.

Not that easy

[dbateman]

I see a lot of comments saying something like any cracker with an antenna could crack them. By stop and think about what you really need to done this. Telemetry, command and control and antennas on satellites have to be useable at ALL times, otherwise they are useless. Thus this function is typically seperated from the main antennas. If your shiny new satellite is spinning out of control in space due to a bad launch and its main high gain antenna isn't pointing toward the Earth, you want these things to work regardless. Thus the antenna for command and control of the satellite is omni-directional and thus low gain. As a consequence the gain of the antenna on the ground
needs to be larger and thus antenna itself is larger, typically 20m or more in diameter. Thus the equipement required to do this might be available to large government or private interests, its not available to your script kiddies. So if your a running a micro-satellite
thats main reason is scientific research, and you want to share the scientific data in any case, why bother securing it against the few malevolant large organisations that probably 1) have no interest in your system, and 2) would cause a major international scandal if they damaged your system in anyway due to their efforts.

Cheers
David

Vehicle security issues

[Anonymous Coward]

This is a subject dear and close to my heart. I've worked for many years in this very field and
find it fascinating that it has shown up on /.

Yes it sounds like your current architecture is vulnerable to outside vehicle control. There are ways (besides encryption) to control this.

I'm not comfortable discussing this publically however I would be more than willing to chat/email
privately about it.

If teridon would provide a way to contact directly, I will initiate contact and would enjoy sharing ideas.

Cats

[jcwren]

All your satellites are belong to us!

Doh! - And the company he works for is....

[Anonymous Coward]

Look up the user and previous postings (#931886) is a good one. Oops, there goes the obscurity.

To find out where satelittes are is easy, all you need is to down load the two line element files (tle's) load them in to a satelitte tracker program, most of which can control dishes for tracking purposes and you are away.

Is it easy to do? Yes, couple of days reading on ham sites on the net will tell you all you need to know. Will it be expensive to do? Depends on the size of the dish needed and your electronics knowledge , but $2000 aught to do with some spare.

Do people want to? Sure, more interesting that doing windows for the n'th time...

If you want to read some more about using sattelites ask google about 'Dr Dish'...

Re:Doh! - And the company he works for is....

[Anonymous Coward]

goddammit, a link would have been nice!

DONT&nbsp MAEK&nbsp ME&nbsp HAEV&nbsp TO&nbsp GET&nbsp ALL&nbsp JEFFK&nbsp ON&nbsp YUOR&nbsp ASS!

Re:Forget reverse engineering -- who's quit lately

[Anonymous Coward]

Forget about running another cable. While YOU may not check the dish in your backyard very often, you can bet that any extra wires, especially those that don't go to the control center will be found VERY QUICKLY at a large facility. (Perhaps even by the lawnmowing guy.)

However, these dishes are actually large, concave, parabolic mirrors. Might it be possible to bounce a microwave or other radio beam (of the right frequency, of course) off the "official" dish and to the satellite?

Since (presumably) satellite downlinks cover a large area, recieving is not a problem.

As for sighting a satellite, it is possible to actually see quite a few satellites on a clear night in a rural area (or with a light pollution filter). It is possible to determine which satellite you see with only a little not-too-specialized knowledge and what orbit and about where on that orbit a satellite is.

(Sorry for the rambling/runons/etc.)

Oh, pleeeease!

[Anonymous Coward]

One SCUD with a paylod of BBs will put the Great Satan out of the satellite business!
-- Saddam

The unhackable system

[mlheur]

I know, troll, troll, troll...
but I like my unhackable 286 that I threw away after having pulled off all the chips and cracked open the ceramic casing on the CPU, and dismantling the HD and putting the platters on my cork board...
But it proves the points that a system can be unhackable, and it helps the point that there's a balance between hackability and useability.

Re:I assume the run of the mill reply to this is..

[cscx]

It was actually a joke, in reply to the original joke about making it run linux and open-sourcing all of the protocols. Some things are meant to be funny...read up on it sometime.

Whew! I logged in and saw the original message and wondered for a sec... I'm glad that someone found the humor in it and didn't dismiss it as a 'troll' or 'flamebait.' I'm glad I don't have to tell you about the IIS server I ran (I'm not the admin anymore) that has had over a 2 month uptime. Remember, regardless of the OS it's running, if it's set up by a knowledgeable admin that configures things properly and securely <?insert_here(sheepish_grin);?> you'll get good server reliability. And no, before you ask, I don't have a bridge in New York to sell you! :o)

Re:I assume the run of the mill reply to this is..

[Anonymous Coward]

Not the reply I was expecting. Kudos!
heheheh ;)

Mode Change?

[Anonymous Coward]

My suggestion would be:
If the satelite is not streaming data all the time, then I would make it stop transmitting all data when commands are being issued. It would also then need to Tx confirmation to the base station and then receive the appropriate confirmation. In this way all legit users would know that the sat is being tampered with and they could swamp the Rx by transmitting a couple of dB's higher until they had triangulated the hacker and sent the nuke to get him...

You might be able to quite easily get an appropriate signal to the Sat... but to have the appropriate modulation etc might be more difficult. We are assuming that this is not a communications sat, if it was and could receive signals across a range of frequencies it would be fairly easy to prevent the average financially challenged hacker from talking to the sat.

I think it is fairly easy to protect these sats from hacking. I am surprised that this question was even asked, unless it was from a person who had some but not enough information to think that he had discovered that his company's sat was unsafe...

RF Rules!!!!!

[hughk]

Your transmitter probably isn't that powerful, and the dish not that big after all, the main factors are cost and reliability.

All I need is another 3db or so either by a larger dish or a more powerful transmitter and I can flood most receivers. PLLs will tend to capture my signal rather than yours.

There are radio amateurs with 10m dishes who can put out a few kilowatts. The dish is hard to hide though in an inhabited area. Note that an uplink for a TV remote vehicle is relatively small at about a couple of metres.

There are transmission design techniques, such as that used by GPS that make the signal far more difficult to swamp. The receiver is 'looking' for a pattern in the signals and will reject signals that do not fit that pattern. Such a receiver is far more difficult to swamp.

TTAC Locations and timing required to hack a bird

[Alascom]

Lets look at Iridium as an example:
Motorola controlled the Telemetry Tracking And Control (TTAC) function for Iridium's birds. The satellites were controlled through, of all things, SNMP! Yes, its true. SNMP issued commands controlled the basic functions of the satellite. Commands were issued from TTAC's to the birds as they passed overhead. One can only communicate when the satellite is over the horizon of the transmitting/receiving TTAC, you can't just broadcast a signal from anywhere and hope the satellite gets it. NExt, you can only communicate with a satellite thats listening. Power consumption is a critical issue in satellites (no 120v ac in space.) Therefore, the satellites only listen and transmit when they are overhead of a TTAC. The signal must be coming from or going to the general area of the TTAC (its directional). Because they communicate as they travel overhead, the distance involved, etc, this creates a distorted egg shaped signal "footprint" around the TTAC. When the bird is directly overhead, the footprint is shaped like a circle (for Iridium, approx 20 miles diameter), then back to an egg shape as the bird approaches the far horizen. Any HAM/hacker wanting to snoop or squash the TTAC signal must be in the general vacinity of the TTAC in order to be able to receive or transmit effectively.

Motorola had several issues that are probably prevalent thoughout the commercial sat industry. First, the TTAC stations WERE connected to the rest of the Motorola network, which in turned connected to 3rd party networks, and on an on. Even though Firewalls, ACL's were used, they were based on very general rules, usually restricting to broad networks. Also, dial-in was supported on routers throughout the network for maintenance, so the best way around the Firewalls would simply be Soc. engineering a router password and dial-up the TTAC router/switch.

This could be achieved by: Located the TTACS for the satellite in question, usually public info. Get any phone numbers at that location you can. WAR dial a range of numbers around the TTAC numbers and note any Cisco devices answering. Use the SE'd passwd on the discovered Cisco dialups until you find a winner. Once in, either swipe the control apps for your own transmitter/reviever, or perform a one time attack since you unlikely to get a second chance one they notice.

SIDE NOTE: There is NO chance of anyone ever using a satellite to crash into another bird. It takes motorola several months just to move 1 bird from orbit A into adjacent orbit B. Fuel is extremely limited on these things. Besides, picture the entire earth as a parking lot with 50,100 or even 500 hundred cars continuously driving around on it. What is the likely hood any of them will ever collide, much less run into each other. Now imagine it with each car having 1 gallon of gas to use. The logistics now become very clear.

Re:I assume the run of the mill reply to this is..

[Kallahar]

Bad idea, for the following reasons:

1) It takes more time than that to verify the fixes, test the changes, and upload it to the satelite. Add in insurance costs since one bad opcode could shut down a $50 million satelite and they want to make sure it WORKS first.

2) The entire OSS community will not help out all at once. The people likely to help will be the one's interested.

3) Unless they have an excellent response system already in place, more hacks will be done in the time between fixes (at least in the beginning) than would happen now (through obscurity)

I completely support open standards, but it is sure a lot easier to START with them open, rather than investing a lot of money and effort and then opening them up...

satellite Solution

[Anonymous Coward]

Since the economy is soooo bad, couldn't you just hire someone to sit in the satellite with a joystick in their lap?

Re:All the ground-based security is well and good.

[Anonymous Coward]

Fuck you! And get off my front porch, you young whippersnapper!
Stupid smartass kids. It's pretty obvious from the fact that I'm here that I value my privacy!

Security thru obscurity

[PhipleTroenix]

You had it unitl you posted here. You no longer have obscurity. Now there are 1000 /.ers tyring to hack your satelites.

jamming

[markmoss]

Can someone effectively execute a DOS attack by uplinking to the satellite with a powerful signal

It's certainly possible, and it's called "jamming". This costs a lot for plain random troublemaking; it takes a steerable dish and a fairly high powered transmitter, with a big electric bill. It seems rather unlikely someone with that budget would spend it just to mess up a science experiment. But unless considerable effort goes into protecting a satellite, jamming it would be small potatoes for a military operation.

There are some substantial (but very secretive) defense contractors making radio and radar jammers for the US military. To jam a satellite using a fixed command frequency, you just point a dish at it and transmit at the same frequency with at least as much power as the actual command center. (I mean power delivered to the satellite antenna -- that's a product of the actual power and the transmitter dish's directionality.) The two signals basically add together, so if the jammer just sends a non-varying signal it's quite likely that the receiver will still be able to pick the commands off the top. But just about anything that varies without too much predictability will do for a jamming signal -- white noise, classical music, Slim Pickens yodeling, Howard Stern...

The most common method of defeating jamming is to change the frequency. Every so often, computers on the ground and in the satellite compute a psuedo-random number, and change to that frequency. It's easy to do that once or more a second, and the jammer is not going to be able to find the new frequency fast enough. (Assuming the number sequence is secure, against both espionage and cryptographic reverse-engineering.) However, if they _really_ want to knock you off the air, it's possible to transmit a very high powered broad-band signal to jam all the channels at once. If there are 1,000 possible channels, the jammer has to be 1,000 times as powerful. Do that to a US military satellite, and I think you will knock it out for a while, but: (1) in a few minutes the satellite orbit will take it out of view from your dish; (2) unless you're a nuclear power, eventually they'll get permission to send a cruise missile into your ground station; (3) That much broadband power will mess up other communications as well, and get other countries mad at you. There are stories that the Soviets used to play a little with our satellites and vice-versa, but nothing serious because both sides had too much to lose...

Another protection against jamming is to use a very directional receiving antenna, so any jammer would have to be on territory you control. This also substantially reduces the required transmitter strength. The problem is keeping that receiver dish pointed at home. In a satellite, you would have to also have an omnidirectional backup antenna, to use to re-gain control if the satellite tumbles. This makes it more complex and expensive than frequency-hopping.

Get a Space Dog

[coniote]

A laika like dog coud be trained to guard the sat.

Satellite uplink security

[Anonymous Coward]

DOS attacks seem possible. If an attacker just wanted to lock up the reciever on the bird, the strength of the signal hitting the bird would matter. A large antenna would obviously help, but the antenna gain is only one factor. Another is the power output from your amplifier. One could use a much smaller antenna if one had a powerfull enough amplifier. Building a high power amplifier gets difficult as the frequency goes up. Feeding that power into an antenna, especially at microwave and higher frequencies, requires very precise alignment of waveguides, etc.

Some obvous steps might be to have the satellite only accept commands at certain times of day (but this would be trouble if you have an emergency), or only when commanded on by some series of signals, or the presense of a particular sub-carrier, or some other such notion, i.e. some way to "turn on commanding mode", so the default is to not accept commands and therfor the door isn't always open...

You could/should also employ some sort of command verification step, where the vehicle would echo
the command to be exectuted, and then await confirmation before execution. Confirmation could be via a different uplink frequency, or an encrypted password, etc.

ground antennas to command satellites would probably have a fairly narrow beamwidth in order to be efficient. Anyone transmitting with a high signal strength would be pretty easy to track down -- just fly around with a spectrum analyzer and look for the signal.

A log kept by the satellite of all contacts, commands/times/etc might provide some warning -- If someone was really going to try to control your bird, they'd likely have to make multiple attempts.

You could pre-assemble the commands into a block before actual transmission -- then send it all at once, in seconds. 'Harder to record/analyze/decipher that way...

worth the time?

[markmoss]

I mostly want opinions on whether cracking a science satellite would be worth the time.

Let's say some nation (**cough**Iraq) gets tired of American spy satellites watching it. I hope these satellites have pretty secure command authentication. So instead, they take over the steering of other unprotected satellites and try to run them into the spysats. Even if they miss, your experiment schedule is ruined.

If you are depending solely on security through obscurity, cracking it is going to be much easier than getting a shoe full of plastic explosive onto an airliner... Just a few random ideas: (1) Record a few thousand transmissions, and what the satellite does after receiving them. Hire an out of work Russian mathematician to correlate them and reverse engineer the protocol. Heck, I once had to reverse engineer a communications protocol because the developer hadn't completed the documentation; it's not that hard. (2) Get a spy on the payroll. American science researchers love to hire foreign kids with no idea of American pay scales. (3) Go dumpster diving. Chances are you or your customers are printing out command sequences to be checked, and then tossing the printouts in the dumpster.

So you really should be using a cryptographically secure authentication scheme. As it transmits a command, your computer adds a timestamp, computes a hash of the command, timestamp, and a secret key, and appends that; the satellite checks the timestamp is reasonable (within a second or two), then also computes the hash and checks it. If you can keep that one number secret, you are secure as far as taking over the satellite goes.

Hubble upgrade

[KjetilK]

If the Hubble has a 486, it was almost certainly an upgrade!

Yes, you are entirely correct about that, it was inserted on a spacewalk. However, the article mentions that Pentiums wasn't ready for space.

A few suggestions...

[grungie]

I've worked in the satellite industry as well and there are a few things I can tell you from experience:

- anyone can download the CCSDS PDF documents describing TM/TC links, error correction codes,... And although not many attackers would be courageous enough to implement the whole protocol (I implemented it partially and it was quite lengthy), tiresome bits like reed-solomon and viterbi are freely available from some internet sites. I would say that the protocol aspect is not a security guarantee, since I for instance could develop the protocol stack.

- As for the hardware, you are kind of right saying not many people would have the right antenna. But it must somehow be possible to use compact antennas/modems since you can buy satellite telephone handsets and most telephony satellite are geostationary (> 30,000 Km). Off-the-shelf satellite reception systems exist and are pretty affordable but I don't think the same is true of transmitters. Depending on the kind of modulation used (It's usually QAM, I think) and the availability of commodity hardware, you would have to be a reasonably skilled electronics and telecom enginner to mount such an attack.

- Now, assuming the threat actually exists, I would probably foresee a narrow emergency TC link off the main TC band, so that I can upload emergency commands to the sat. Also, if your TM bandwidth allows it, you may have all TC's echoed to the ground. This way, if someone is attacking your satellite, you would notice it immediately and could possibly also locate him/her. And I don't think you could DoS a satellite for long before getting caught, unless you start using mobile attack equipment: 3 satellite would suffice to locate you and the sidelobes of your antenna could betray you on the ground as well.

What you're telling about unencrypted streams is amazing. Most commercial or scientific satellite I've seen so far use 3DES or a similar symetric algorithm, for uplink at least.

Note: I'm not an experienced space engineer. It's just that I've worked some time in the field. So don't take my suggestions for granted.

grungie.

Don't know what you are talking about

[Anonymous Coward]

Most often spacecraft have different uplink/downlink frequencies. In addition, there can be differenct frequencies for "consumer" data and "command/control/telemetry". Thus, "snooping the bird" is probably not what you think it is. Most likely you would be sniffing the wrong frequencies. Also, using spread-spectrum modulation, it is no longer so simple as to scan a wide frequency range looking for a signal....you may never see it - it can be within the noise.

In addition, the uplink and downlink frequencies are RF. In reality, these high frequencies are used as carriers, the data is modulated at an IF level within the spacecraft and groundstations. And then typically, the IF is again converted into synchronous bit streams to the computer systems. Thus, there are a few layers of modulation/demodulation you need to figure out.

Groundstations are not necessarily expensive systems if you build them yourself. However, this can be expensive as far as being time consuming. Many low earth orbiting spacecraft groundstations only need a few watts out of the groundstation to a low gain antenna. This is not the problem, the mixing frequencies are more of the problem.

If you can get this far, then you will have access to the bit stream that most of you think you have easy access to (like snooping a tcp udp packet). Getting to this level is not as easy as it sounds. I suppose here is where things can get easier, especially if you do not use encryption.

Unfortunately, as mentioned a few times in other posts, the frequency of a specific command being sent is probably not as often as you think. And, you would need to "sniff" enough "packets" at the right times to proceed.

Anyhow, to make a point, I suppose if the ground station computer systems are reachable - even indirectly - via the Internet, I would be more concerned about that link since it would be a lot simpler to hack that then the RF/IF/packet. Or, I would be concerned about the groundstations being physically accessed. And, finally, as mentioned already, source code and hardware documentation would be the best stuff to keep "secure" since these are the blueprints to making the system.

Bumper grounding.

[McFly777]

you had to park with your bumper against a grounded barricade so that the car wouldn't act as a capacitor and build up a charge...

Gee, I would think that could be a problem for more recent vehicles. Most of them have plastic (non-conducting) bumpers!

Re:Bumper grounding.

[Anonymous Coward]

you had to park with your bumper against a grounded barricade so that the car wouldn't act as a capacitor and build up a charge
Not so. I have toured the Jim Creek Naval Radio Station, and there is no requirement to ground carpacitors. The antenna is amazing, and spans a valley, probably 600 - 700 meters. Water from Jim Creek is used for cooling some component, I believe

Correction:

[Anonymous Coward]

should read:
"One SCUD with a paylod of BBs will put the Everyone out of the satellite business!"

Why not use a one time pad?

[diorio]

for as little uplink time that you require a 100GB of one time pad data should suffice. Especially if you use it for critical commands only. (ie. Shutdown, Re-task, Software/Firmware revisions)

Re:the very fact that you told us how you already.

[nehril]

... and that to attempt communication you need a radio antenna.

I can't believe he let that slip either! I mean, really, now everyone knows that his satellite com link isn't a really long ethernet cable.

Probably not everyday hackers, but Saddam? China?

[fortinbras47]

There probably isn't any real threat from everyday hackers, but even though it's pretty far out, messing with satellites using security flaws wouldn't be out of reach of well funded terrorist or rogue states. I mean, I think the chance of this is remote, but it would be pretty ugly if some group/rogue state managed to disable/fry a bunch of satellites.

i have some experience here

[j h woodyatt]

In a previous life, I worked for a major American space systems company. I worked on the ground station software for the command and telemetry systems in Intelsat VII and the NTT N-Star series. I had brief affairs with command and telemetry for a few other spacecraft. Those are my bona fides, and my resume is on my web page.

On the issues that concern you:

1. "Can someone effectively execute a denial of service attack by jamming the uplink signal at the analog level?" Yes, but you might be able to make it hard enough that it costs more money than it's worth. Remember that such an attack will have to be launched from near the terrestrial location of the ground control station. There's some steps you can take to use that to your advantage.

2. "Can you decipher the semantics of the command set?" We're assuming I can spoof the uplink and send random command strings and get them executed by the bird? Access to the telemetry would be crucial here. If I can't read the telemetry associated with valid commands, then the best I can hope to do is to upset the bird on my second or third valid command. Actually controlling the bird for a useful end is probably out of the question. (Though, it might be worth billions of dollars just to be able to kill the bird.) So: Encrypt the telemetry. Put the keys in God's Own Safe. But PLEASE don't let script kiddies execute valid, randomly generated command strings on birds they don't own! At least, force them to steal the symmetric keys for encrypting the command strings from the same safe you put the keys for encrypting the telemetry.

3. "Are the standards based approaches secure?" They're basically as secure as the setup you're probably using now. Maybe a little more secure, if the implementations you use are very mature and security experts have been grovelling over every line of their code since Turing was a teenager. You *ARE* planning to make all of the avionics code upgradeable on orbit, right? Security depends on the timely application of patches, you know.

--

Security through lack of resources

[Anonymous Coward]

as a military member with some experience with satcom, i can say a few things on this. the first being that in order to even GET the frequencies you are using, you will either have to get right up to the antenna(trespass?) or somehow get in between the line of sight with the sat and your transmitter.(fly around and hope its overhead) secondly, a simple thing is to have a special identity code contained in transmissions to the bird. doesnt even have to change but once a month couldnt hurt. someone would have to de-engineer the command structure to FIND where the ident code is, and then its only good for so long anyhow. not even a encryption key, no SSH, nothing. one of the systems i operated had encrypted uplink/downlink, but then you also needed a identity number, which changed monthly. net control station could remove the identity numbers allowed access. a DOS attack, by using a steady transmit can and WOULD be located quickly. A common problem we saw with improper equipment setup. A sideband was used to re-tune the reciever, i believe. so now you need: a plane, a wideband reciever to try and locate the correct signal, a transmitter and antenna, and some idea WHEN the satellite is overhead. sounds like several people and a good $ backing is needed before you could really go for it, and then whats the purpose? you dont even know what sort of equipment the bird is carrying yet.

"obscurity is not security"

[robvangelder]

I was under the impression that all security is obscurity, just different levels of it.
I mean, isn't encryption just hiding the magic 500 digit number?

Satellite Security.

[Aero_guru]

Well, this is my first post on SlashDot, eventhough I have been reading it for many years. I couldn't pass up the opportunity to provide some comment on this subject as it pretains directly to what I do for a living. I have designed satellite communication systems (on the ground, and on the spacecraft) for several DOD, NASA/JPL, and commericial programs, and I have a few comments and thoughts to post on satellite security. As to the main question, would it be time worthy? I would have to say No. It would take a significant amount of expertise and knowledge to even know where to begin, not to mention a lot of really expensive hardware. First of all, DOD programs without a doubt are going to be encrypted. Commercial satellites as well are normally going to be encrypted. Nasa/JPL, also uses encryption, though not to the same extent, and not on "all" satellites. But even without encryption (and we will talk about the RF in a minute), there are other factors. Commanding a satellite is not like sending an email. There is a complicated command structure which is invariably different on almost every satellite. This structure would be most definately be difficult to decipher. Commands are also subject to onboard (satellite) logic to determine if the command is real (ie. does it make sense?, is the command sequential with other commands?, does it commence at the right time?). This is done more as a check and balance against ground operators, than "satellite" hackers, but it complicates the matter either way. The downlink is even worse. Even "if" unenecrypted the downlinked data, will most likely use several different data rates, on multiple carrier/subcarrier configurations. The telemetry will most probably be further convolutionally or reed solomon encoded, and lets not even talk about sub-commutated telemetry options in which the format of the telemetry frame will change on some pre-defined basis. Now, as for the RF. Can you "jam" a satellite, to perform sometype of DOS attack. Yes, if you had the proper equipment, and (here's the tricky part) could "out-RF" the people who use the satellite regularly. Lets use a commercial buisness as an example. Buisness A, has probably spent 2+ million dollars, on a 10m+ antenna to talk to their satellite. They are most likely implementing a pricey HPA (high power amplifer), sufficient to provide 30-40 dB of link margin on the uplink. I don't many ham's with access to this type of equipment. As for the physics. Well, theres all kinds of other problems. LEO satellites for example MOVE. Theres the astro-dynamics to consider (ie. where's the satellite you want to talk to). Things like RF doppler shift and antenna pointing accuracy come to mind. Not to mention downlinks will only happen if co-located with a "real" ground station. Geez, there's lots of other problems I dont even have time to mentions. Differences between CCSDS and SGLS, different RF bands, satellite command addressing.... Anyway I guess the bottom line is, I don't loose any sleep at night over satellite security. Laters J

Re:Satellite Security.

[cvoid]

I know quite a few hams with access to this equipment. It's fairly easy to put together a satellite station, including dsp for demodulating various encoding methods. Hacking wireless data streams has been going on for the last 20 years, it just isn't as mainstream as say, hacking AOL. There is readily available code on the net for decoding all kinds of data streams, and as for LEO's moving... yeah, they move. Thats what az-el rotators are for. Again, you can buy one for under $1000, or build one out of a couple of cheap TV rotators. Hook that up to a controller, fire up your favourite tracking package and away you go. The element sets for most non-military satellites are readily available.

Simple satellites such as the NOAA apt satellites are easy to receive and demodulate, and Monitoring Times had a nice article on decoding (by hand) Russian satellite telemetry.

It isn't a matter of anything but time, and a desire to do it for the sake of doing it. My advice? Use encryption. Strong encryption.

Keplerian Elements for most satellites, links for tracking packages, and telemtry decoding packages are available at celestrak, as well as many other places:

http://www.celestrak.com

Houston, you have a problem.

[Zeinfeld]

I am pretty well known as a security consultant. My advice is that you immediately get someone who is a top rank security protocol designer to provide you with a cryptographic solution fast. To do the job well you should expect to pay a minimum of $100K for the design plus about the same for implementation.

To answer the questions you pose:

Do I have a problem

If you did not before, you do now. Hint, if you rely on security through obscurity to secure a $50 million piece of hardware then best not tell the favourite news site for much of the hacker community.

The threat comes from two sources, one is bored teenagers who can't get a girlfriend, the other is an attack by a well resourced adversary such as a hostile government, a major terrorist group or organised crime. The teen hacker problem is non-negligible but the well resourced adversary is more likely.

Post 9/11 concern about infrastructure attacks is much greater. As a result the insurance syndicates I advise will shortly be requiring you to secure your communications links if you want to insure the bird. There will also be increased pressure from governments, particularly in the US to secure posibly sensistive infrastructure.

Are the existing security measures sufficient

Absolutely not. In the first place by relying on security through obscurity you are putting your employees at risk. A motivated attacker would have no qualms about kidnapping an employee (or a member of their familly) and forcing them to reveal the necessary information.

A more sophisticated attacker could obtain the necessary information simply by discovering the location of your site and visiting it with a suitably sophisticated scanner. Even the best dish does not direct 100% of the signal at the satelite. There is plenty scattered arround the dish. Intercepting the signal is not a major difficulty.

Even if you have a large security perimeter arround your upload point (e.g. at a military site) the attacker could use an aircraft. Even a model plane might be sufficient to detect the carrier frequency.

If the attacker can intercept the signal they will have no difficulty decoding your command sequences. It is quite likely that there is information available to the public in any case. Much of the software used in that type of application is canabalised from one project to the next. You might think you have a one off that is unique but it might well turn out to share 80% of its code with another bird used by some obscure company (or university!).

What should I do

This is not a hard problem for an expert to solve, but I really would not go at it armed with only a copy of Applied Crypto and enthusiasm. Security protocol design is a subtle business. The 802.11b folk who tried the DIY solution failed. If you are going to get your bird insured you will probably end up having to have a recognised expert check the design.

What you really need is a means of authenticating the commands sent to the bird. The easiest and most lightweight means of doing that is to use a message authentication code such as HMAC-SHA1 or one of the AES MAC modes. You need to establish some form of shared secret between the bird and the control station, this is simply a very large random number.

You may or may not want to bother with public key infrastucture. If you want to launch your bird on a Chinese platform you might not want the shared secret to be present on the bird when you launch. So you embed the public component of some private key in the bird and do some form of key exchange (don't do this at home, contact one of the people involved in the IETF design of the IPSEC key agreement protocol).

Incidentaly the attack you are protecting yourself from there is not the Chinese stealling the key (unlikely). A more likely form of attack is some jumped up pipsqueak senator looking to make a name for himself with a grandstanding attack on your perfidy (ask the directors of Loral).

Securing the link is the easy part, securing the shared secret to secure the link is harder. Some form of PK based key splitting scheme may be needed.

In summary, go see a specialist. Someone like Paul Kocher at Cryptography.com, Eric Rescorla at RTFM.com, Derek Atkins (warlord@mit.edu) is also highly competent. Expect to pay a lot more than you expect. The best people charge from $2,500 a day to $5,000. There are some who charge more, you will have great difficulty hiring them.

Re:Houston, you have a problem.

[Anonymous Coward]

I am pretty well known as a security consultant. My advice is that you immediately get someone who is a top rank security protocol designer to provide you with a cryptographic solution fast. To do the job well you should expect to pay a minimum of $100K for the design plus about the same for implementation.

And how much should he pay for consulting? This kind of hysteria is really annoying to those of us trying to get real work done.

Preferred bird-hack

[mbstone]

I haven't seen anybody come up with a worthwhile satellite hack: here's one.

You introduce 2-3 minutes of digital delay into the video signal, prior to the uplink, on the feed from your local racetrack. Then, you call up your beard at one of the big sportsbooks in Vegas and have him bet, past-post, on the winning horse.

Or, if you can't or won't or are too chicken or can't afford the terabytes of RAM necessary for all that digital delay, this is what you do. You find some rich crook, say Doyle Lonigan. You have somebody, say Robert Redford, convince him that you actually do have 3 minutes of DDL in front of the feed from Aqueduct or Churchill Downs or wherever. You take Lonigan to this big telco-room full of equipment racks and introduce him to Ray Walston who, you explain, is a crooked videotech who is in on the scam. Then you get Paul Newman to set up a "big store" that is an identical replica of the sports book at Caesars. You call Lonigan on his cell phone and give him a convincer (a winning bet). This puts Lonigan "on the send," and he comes back to the store with a wad of dough. You then ring up Lonigan and tell him to place the money on [your favorite horse]. But the horse actually comes in 2nd. When Lonigan complains, you tell him you told him to -place- the money, you idiot. Then bogus cops come in and shoot Redford "dead." Lonigan splits and is never seen again. Redford, Newman, et al. split the take. The best part is, you don't really have to haxor the bird or even buy any RAM.

Three major issues

[thewiz]

The three major issues you ask about are ones that the military put much time and effort to address on their satellite programs. Having worked on projects for a military contractor, here are suggestions:

1. DOS attacks - I've actually seen a military site lose all communications to the satellites that it was controlling because of an inadvertant DOS attack. A company near the base had installed a transmitter that was MUCH more powerful than was allowed by the FCC in that area (because of the military base). When they switched it on, it disrupted all the transmitters on the base. The military used specially equipped helicopters to triangulate the source of the signal and deployed a security unit to shutdown the transmitter. The FCC revoked the company's license the same day.
Note: The military did NOT lose command or control of the satellites because they use multiple command and control sites; they simply had another site take master control while the site I was at was disrupted.

2. Deciphering the C&C structure:
This is something that many foreign countries have been active in doing for quite awhile. Don't think it hasn't been tried.

3. SCPS
A really stupid idea; it would be better if the command and control aspect were NOT part of this (keep it separate) and only those things that the public or scientists would be interested in be part of SCPS (Cameras, science instruments, etc). Make C&C accessible from the Internet is just plain foolish.

NOTE: There are three things that the military determined were of the utmost necessity for ANY satellite communications (uplink and downlink):

1. Isolation of command and control networks (NO outside access allowed)
2. Multiple command and control sites that monitor each other and
3. CRYPTO - it's best to do hardware-based crypto on your up and down links. A fool and his satellite communications will be monitored if you don't encrypt your commincations.

Issues in satellite security.

[aebrain]

My 2 kopins worth

Any idiot with a sufficiently powerful transmitter can DOS a scientific LEOsat while in the footprint, with less than a thousand bucks of hardware.

For the info of /.ers most LEOsats adjust their attitude with magnetorquers and reaction wheels, they are incapable of changing their orbits even if you snatch control. But you can, over successive orbits, put them into power-draining modes that will cause eventual loss of the bird.

LEOsats are also only commandable from one groundstation for 1-2 slots of 15mins or so per day.

Many scientific satellites use the ESA PUS standard high-level protocol (PPT here) on an AVTEC box or something similar, using CCSDS. It would be trivial to "crack" (since it's not encrypted), given a hundred thousand bucks for the hardware.ROT-13 is harder.

In summary, any moron can make life difficult for researchers. But firebombing chemistry pr CompSci labs would be just as "clever", far easier and cheaper, and even more annoying.

BTW unlike some who think this is a troll, I'm concerned about the issue myself. But given the hardware cost of implementing a reliable CCSDS protocol, only fairly wealthy hackers could do it. The Software is relatively easy for real-time programmers, but script kiddies, VB-jocks or even C coders need not apply, Ada would be the best way to do it with assembler second. The additional security of adding encryption on top would be negligible, as wealthy hackers could be expected to have access (hacked or legit) to arbitrarily large amounts of computing power. And any script kiddie could DOS us with a five-hundred-dollar jammer anyway. For 15 minutes.

Re:I assume the run of the mill reply to this is..

[Hast]

Generally I'd assume you don't want to run IPSEC or similar for satellite comm. For the same reason you don't want to use PGP for auth. control.

These system have very limited processing power and you don't want to waste bandwidth neither.

So solutions would have to be efficient as well.

Re:TTAC Locations and timing required to hack a bi

[LeBain]

It takes motorola several months just to move 1 bird from orbit A into adjacent orbit B. I'm sure MOT's goal is a controlled orbit change. What if the goal weren't a controlled manouvre?

Re:I assume the run of the mill reply to this is..

[Doug Neal]

Obviously you don't actually run the code on the live system until you're satisfied that there ARE no exploits anymore.

Publishing code to a mission critical system that you know to have exploits is dumb, yes.

Using code that you know to have exploits in it, in a mission critical system at all, is even dumber ;P

An example of GPS DOS

[xixax]

See http://www.vertic.org/tnv/may00/science.html for a run-down of a story New Scientist ran some time back. For $7,500 USD they managed to DOS GPS over a wide area. I also wonder about the feasibility of attaching one of those explosive EMP generators to a wave guide or something.

Xix.

The weakest link...

[LuckyJ]

Don't leave a weak link...

Command your own satellites!

[Anonymous Coward]

Command your own satellites.

It's not as if you can tweak the orbital parameters as easily in real life.

Catagorized under Spam?

[MobyTurbo]

This article uses the piggy spam icon and if you click on it it is listed among the spam articles rather than in the "ask slashdot" catagory. It looks like someone made a mistake that needs fixing, especially since it's a little more than just cosmetic due to the topical indexing error.

Re:I assume the run of the mill reply to this is..

[DerekLyons]

Well, having code up for public review will only do you good, if you have a decent security design as a starting point.

*And* if a competent programmer reviews it, *and* if the programmer is familiar with the type of system he's reviewing.

Open Source is a tool, not a solution.

Sweet

[Transcendent]

Now I can control a spy sattelite and take a peak at some hot girl showering... heh heh... oh wait... line of site... damn!

Time + facilities = havoc

[tchansen]

Never Underestimate!!! I don't know much about RF communications with satellites, or how powerfull it has to be or whatnot, but I'm pretty sure if someone was determined enough, they could hack something togather. Or if they work at a radio station in a small town that goes off air at night. *shrugs* who knows.

I previously worked for a local television station with satellite uplink facilities. We were taught how to uplink for news feeds and were relatively unsupervised between 11:00 pm and 4:00 am. These were positional antennae since we used multiple satellites depending on usage. I don't doubt that with a little bit of knowledge, some free time and available facilities someone could play havoc.

Arm with lasers

[walt-sjc]

Yes, that's right. Best security you can have is to arm the satellites with lasers so you can shoot anyone running nmap on your bird...

Seriously though, how many /. readers are experts in satellite security? Why ask here? Must be a REALLY slow news day to post this kind of thing...

CNN

[kruczkowski]

I knew this guy who was in the Army and worked at AFN (Armed Forces Network). He told me that they easly take the cnn satilites if something was wrong with there own. I don't know if cnn knows or cares but he put it in a funny way, "CNN is everyware so why make a backup network if all you have to do is borrow someone elses"

I guess a terrorist would not want to attack CNN.

Are you kidding?

[Anonymous Coward]

An unencrypted command link w/a 'secret' command set?! Are you kidding. Did you listen to what you just said here?

First off, if I can get a pringles can yagi to extend my 802.11 link, I can sure as hell work up *something* to pick up your transmission from a nearby hill...

That said, it's UN_ENCRYPTED! What could you possibly be sending/receiving from the sat? There's going to have to be a handshake, an 'authentication' of some sort, then a command... So we capture some traffic... Then the Sat's going to return some info... Oh what could it be? Try running it through any of 20 different algorithms to see what surfaces... Pictures? Plain ole temperature data? Lat/Long data? Sorry for the pun, but that won't be rocket science to figure out...

If I want to DOS it - then again, I can build a small antenna, hide it in a nearby tree, and power it with *something* - I'm sure I could whip up something with an old junk microwave that has it's safety's disabled... Powered by a couple of spare 12V marine batteries and a few converters... OR, if I don't want to broadcast my location - how about a spark gap transmitter that keys in every so often - good luck in finding it... I could even make it solar powered...

Don't get me wrong - I'm not advocating any of this - but it's entirely doable by someone with a weekend of free time. You should encrypt the uplink, downlink, and authenticate all commands - especially ones related to guidance control. Have some other general RF monitoring equip to look for new/odd/strange signals on your band, and try to triangulate so you can have the appropriate authorities check things out... Have your bird default to "DO NOTHING" if it receives a bogus or half-baked command...

And forget the private/self-developed command sets. I just don't see how they could be useful from a security standpoint (even if the connection was encrypted...but that's a different topic). Stick with a standard and extend it if necessary. It'll cut your costs, and make building/setting up new sats easier...

Put your authentication keys in the sat - that would see reasonably secure to me - no one's gonna steal them up there - unless they happen to have a spare shuttle at their disposal...

Iridium LEO sat system security

[IsoQuantic]

[From 1992 to mid-1994 I was leading the Motorola Iridium network architecture team defining the Iridium system network protocols and assessing the entire systems's payload bearer performance. Although the below comes across as rah rah Iridium, I am no fan of the Motorola executives who botched the entire Iridium project, costing Motorola and Iridium investors $1B+. I am looking forward to my day in court facing these boneheads one day.]

As someone posted earlier, the Iridium birds are controlled using SNMP semantics, but the poster neglected to mention that these packets are transported inside an uplink control stream. The data streamn is a randomly changing and highly encrypted (I could tell you but then I would have to...etc.) K-band control uplink. The uplink itself is via, er, 'a few', globally linked, fault-tolerant, control stations.

To hijack the satellite control uplink would require access to the physical property of the uplink stations, not to mention having access to the protocol schemes that were devised for this data stream. You are not going to park a truckload of sat gear in the parking lot and go unnoticed. We also spent lots of time determining where best to place these control centers, too, given the geo-political issues.

The originator of this thread is full of angst over the security implications. Bravo! But, rest assured that the subject is not an unknown practice to the aerospace industry. The Iridium system is extremely robust in this particular area, so much so that the revived Iridium system will be carrying lots of DoD traffic. Needless to say, there are always risks when faced with an network attack from a government sponsored or highly funded enemy using equally skilled aerospace technologists.

Talking about high power antennas

[Anonymous Coward]

If you use a grid of (smaller/less powerfull) antennas you could create the same effect as a single high power antenna. So you dont even need to have access to facility with strong antennas except to maybe snoop the protocol...

Put SSSH on it

[Fiznarp]

The Secure Satellite SHell. :)

Fiz

Illegal satellite access

[Anonymous Coward]

I installed uplinks for satellites.I know what it
takes to get into one.First of all it's very
difficult for anyone to get the installation up and running.
Yes you need uplink frequency but you also
need the downlink one too...
Second the modems to access the satellites are
a bit hard to come by..Let alone a microwave
transmitter that you could tune to match the
frequencies. This is no amateur stuff.
Gaining illegal access to a satellite is difficult
at best technically.Financially speaking you
also need to have a good cash flow.The
transmitter and receiver will be an expensive
proposition at best. Of course there is nothing
that will stop organisations from doing it.
For the common folk this is impossible.

Try calling Harris to ask them for a transmitter
receiver that works in the microwave spectrum
I beleive this will raise tons of eyebrows and
probably will end you up in an interrogation
room at the FBI's local headquarters.

But dont take my word for it .. : )

Re:Forget reverse engineering -- who's quit lately

[mpe]

Are your internal machines firewalled completely from the public Internet? Most importantly, how much do you trust the people who know how it works?

Never mind things as sophisticated as computers. How secure is the dish used for sending the commands and the cable connecting it to the control centre?

Humpty Dumpty's

[Anonymous Coward]

Humpty Dumpty's

obscurity is not security

[Shanep]

A common mantra heard from Slashdot is "obscurity is not security", and this is a lesson that teridon wants his company to learn

If anyone thinks it is, then consider what happens when an employee has access to what the company wants to be obscure, then later he becomes a disgruntled ex-employee.

Now, your inside friend, is your outside foe, and he knows all of your weaknesses. Here's hoping the security being used was not just obscurity.