Slashdot Mirror
Hacking a Satellite is Surprisingly Easy (theoutline.com)
Caroline Haskins, writing for The Outline: Hundreds of multi-ton liabilities -- soaring faster than the speed of sound, miles above the surface of the earth -- are operating on Windows-95. They're satellites, responsible for everything from GPS positioning, to taking weather measurements, to carrying cell signals, to providing television and internet. For the countries that own these satellites, they're invaluable resources. Even though they're old, it's more expensive to take satellites down than it is to just leave them up. So they stay up. Unfortunately, these outdated systems makes old satellites prime targets for cyber attacks. [...]
A malicious actor could fake their IP address, which gives information about a user's computer and its location. This person could then get access to the satellite's computer system, and manipulate where the satellite goes or what it does. Alternatively, an actor could jam the satellite's radio transmissions with earth, essentially disabling it. The cost of such an attack could be huge. If a satellite doesn't work, life-saving GPS or online information could be withheld to people on earth when they need it most. What's worse, if part of a satellite -- or an entire satellite -- is knocked out of its orbit from an attack, the debris could create a domino effect and cause extreme damage to other satellites.
A malicious actor could fake their IP address, which gives information about a user's computer and its location. This person could then get access to the satellite's computer system, and manipulate where the satellite goes or what it does. Alternatively, an actor could jam the satellite's radio transmissions with earth, essentially disabling it. The cost of such an attack could be huge. If a satellite doesn't work, life-saving GPS or online information could be withheld to people on earth when they need it most. What's worse, if part of a satellite -- or an entire satellite -- is knocked out of its orbit from an attack, the debris could create a domino effect and cause extreme damage to other satellites.
I'd think a satellite would want some type of RTOS for it's main system. I used WinCE some 15-20 years ago and it sucked ass, but I'd rather use it to control a satellite than I would Win95 (or a modern Linux for that matter).
Windows 95 is a consumer desktop OS? Does the author means that the control software for the satellites runs on Win 95?
I'd imagine that the satellites themselves would use a real-time or server OS i.e. QNX, NT, or a Unixoid OS. Running a desktop OS on hardware with no direct display would be stupid, and satellite engineers aren't likely to be stupid.
What do you want to bet that "Caroline Haskins, writing for The Outline" has no idea what hacking is.
What a terrible article, and by article, I mean Mail Chimp advertisement.
Literally... Chicken little has confirmed it!
Um... Yea, a lot of stuff is POSSIBLE, but the question really is about how practical it is. What's the actual level of risk? Pretty low.
These things are expensive. Older satellites might be vulnerable to exploits launched from the Web, but I've got to believe that such "over the web" control systems are quite well protected and monitored. Disrupting over the AIR (I.E. RF links) are going to require specialized equipment and some specialized knowledge about what you are doing (not all satellites use the same control uplink frequencies), and actually taking CONTROL is like to require insider knowledge of expected modulation techniques, telemetry formats, encryption keys and a lot of other things.
There are a lot of places that have the uplink equipment, though it's not that long of a list and most of that equipment is already being used for commercial applications. An uplink setup is prohibitively expensive for an individual to build and commercial companies that own them like to keep track of when they are used. You could possibly arrange to use one by stealing a mobile unit or breaking into one and using it, but you will get discovered pretty quick.
All this to say, Disruption is easy, so doing a denial of service attack is pretty high risk, you just need to access the right equipment. DOS attacks (and uplink mistakes) happen all the time now. Taking control? Not very likely, very low risk. State actors might have the resources, but apart from that, it's not going to be worth the effort and costs.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I personally integrated many birds for SES, Hispasat, Hughes, NBNco, Echostar, I even retrofitted Terrestar 2 into Echostar 21. Article is BS. Used mostly BAE rad750 processors. subsystems are controlled by MIL-STD-1553 just like your F14 tomcat was initially designed for developed in 1978. Mostly running scripts in either ADA or tcl from ground stations. All their communication is fully encrypted on launch. You could theoretically jam them by blasting the same frequencies, it wouldn't go long undetected.