Slashdot Mirror
Hacking a Satellite is Surprisingly Easy (theoutline.com)
Caroline Haskins, writing for The Outline: Hundreds of multi-ton liabilities -- soaring faster than the speed of sound, miles above the surface of the earth -- are operating on Windows-95. They're satellites, responsible for everything from GPS positioning, to taking weather measurements, to carrying cell signals, to providing television and internet. For the countries that own these satellites, they're invaluable resources. Even though they're old, it's more expensive to take satellites down than it is to just leave them up. So they stay up. Unfortunately, these outdated systems makes old satellites prime targets for cyber attacks. [...]
A malicious actor could fake their IP address, which gives information about a user's computer and its location. This person could then get access to the satellite's computer system, and manipulate where the satellite goes or what it does. Alternatively, an actor could jam the satellite's radio transmissions with earth, essentially disabling it. The cost of such an attack could be huge. If a satellite doesn't work, life-saving GPS or online information could be withheld to people on earth when they need it most. What's worse, if part of a satellite -- or an entire satellite -- is knocked out of its orbit from an attack, the debris could create a domino effect and cause extreme damage to other satellites.
A malicious actor could fake their IP address, which gives information about a user's computer and its location. This person could then get access to the satellite's computer system, and manipulate where the satellite goes or what it does. Alternatively, an actor could jam the satellite's radio transmissions with earth, essentially disabling it. The cost of such an attack could be huge. If a satellite doesn't work, life-saving GPS or online information could be withheld to people on earth when they need it most. What's worse, if part of a satellite -- or an entire satellite -- is knocked out of its orbit from an attack, the debris could create a domino effect and cause extreme damage to other satellites.
Literally... Chicken little has confirmed it!
Um... Yea, a lot of stuff is POSSIBLE, but the question really is about how practical it is. What's the actual level of risk? Pretty low.
These things are expensive. Older satellites might be vulnerable to exploits launched from the Web, but I've got to believe that such "over the web" control systems are quite well protected and monitored. Disrupting over the AIR (I.E. RF links) are going to require specialized equipment and some specialized knowledge about what you are doing (not all satellites use the same control uplink frequencies), and actually taking CONTROL is like to require insider knowledge of expected modulation techniques, telemetry formats, encryption keys and a lot of other things.
There are a lot of places that have the uplink equipment, though it's not that long of a list and most of that equipment is already being used for commercial applications. An uplink setup is prohibitively expensive for an individual to build and commercial companies that own them like to keep track of when they are used. You could possibly arrange to use one by stealing a mobile unit or breaking into one and using it, but you will get discovered pretty quick.
All this to say, Disruption is easy, so doing a denial of service attack is pretty high risk, you just need to access the right equipment. DOS attacks (and uplink mistakes) happen all the time now. Taking control? Not very likely, very low risk. State actors might have the resources, but apart from that, it's not going to be worth the effort and costs.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Naw, the vast majority of commercial communications satellites are still dumb bent-pipe repeaters. There's no security on them, save for nulling antennas and similar techniques.
I used to work for a company that built flyaway VSAT systems, so I know this stuff pretty intimately. A number of years ago, SES Americom (one of the big operators in North America) called me up for help in locating a wildcat transmitter that was causing interference with one of their birds. They called us because they knew we built stable, small aperture uplink terminals that could be a useful reference. Basically they had me transmit a known narrow-band signal at high power, then used that and my sidelobes as a reference to find the offender. After a weekend of doing doppler locating, they tracked it down to about a 1 x 2 mile ellipse, east of Detroit. Their suspicion was that it was a HughesNet terminal, probably on a gas station, that had gone bad.
...si hoc legere nimium eruditionis habes...
This whole article is complete bullshit. Of course satellites do not run Windows 95. GPS satellites alone have existed for longer than that.
Wtf Slashdot?
One might imagine that there are satellites looking down at the earth for sources of interesting, space-beamed transmissions, and their content. There are a lot of monitoring dishes up there these days, pointing directly at that person with a yagi antenna spewing iterations of hack attempts. Then there's a knock at your door.
I'll imagine if you try and hack GPS and other high-value assets, you're not only being watched but by people that play for keeps.
Go ahead. Make some analyst's day.
---- Teach Peace. It's Cheaper Than War.