Has hacking gone into orbit? Satellites and cybersecurity

In the last few years, space-based devices have been increasing exponentially to meet the demands of communications, navigation, and scientific research. There are now about 5,000 active satellites orbiting the earth, with 1,800 launched in 2021 alone.

It’s no exaggeration to say our lives now depend on this technology. According to the National Security Council, a cyberattack on the Global Positioning System alone could cost the US $1bn a day.

The need for space-based technology

As of January 2022, over 3,000 of these satellites are devoted to communications. About 150 are involved in the no less vital function of navigation and positioning. Our planet is enveloped in a moving shell of indispensable hardware. Satellites are a part of every country’s critical infrastructure.

Besides cellular communication, satellites are necessary for transportation, defense, security/law enforcement, mining, agriculture, and energy supply, to name only the most urgent requirements. Any hacker who could successfully disable this type of technology can potentially flip a country from civilization into post-apocalyptic chaos in a matter of days.

How close are we to a space-hacking disaster?

So far, there has never been a hacking episode that unleashed Mad Max levels of havoc and devastation, but it’s at least theoretically possible. In 2018, hackers based in China penetrated the IT systems of satellite operators, defense contractors, and telecommunications companies in the US.

The 2018 episode gave a chilling glimpse of what an all-out cyberattack might be like. Although the actual damage was minimal, the hackers infected the computers controlling the satellites. Thus they could have changed their orbital positions, causing massive disruptions in data transmission.

Increasing connections to space

With the expansion of the Internet of Things (IoT), satellite systems and their users have become more vulnerable. Billions of devices, from home refrigerators to life-saving medical equipment, are connected to the internet, and each is a potential entry point for cyberattackers. The opportunities for hacking are expanding exponentially.

How vulnerable are space-based devices?

“There’s no dark magic in exploiting a satellite”, says Ph.D. candidate and Oxford Rhodes Scholar James Pavur, who specializes in testing satellite security using hackers’ techniques. “It’s just a matter of downloading a few open sources or freely available tools and plugging all of the equipment together and figuring out how to point it at the satellite.”

With about $300 worth of home television equipment, Pavur was able to eavesdrop on satellite traffic from thousands of sources. These ranged from individuals online in their homes to Fortune 500 companies sending passwords for their internal infrastructure.

“We’re not the only people out there who can do this, and we’re fairly certain we’re not the only people out there who have done this,” Pavur says of white hat hackers like himself.

Combating the hackers

With space security in mind, the US Air Force has launched its Hack-A-Sat competition. Teams of hackers from Defcon, the world’s most famous hacking convention, compete to hack into a satellite for a prize of $50,000. This is intended to be a yearly event where the best brains in cybersecurity can search for bugs and vulnerabilities in the latest space technology.

Likewise, the CYSAT cybersecurity conference in Paris in April 2022 will host Europe’s first satellite hack. Ethical hackers from all countries can compete at hacking the European Space Agency’s OPS-SAT satellite (with the ESA’s consent, of course). “We’re asking people to do, in a controlled environment, exactly what we don’t want to happen in real life,” says Davis Evans, an ESA space device manager.

Space-hacking and you

Online threats to individual internet users remain much the same, but they will increase in quantity. As a private citizen, the main difference you will notice in the coming years will be the increase in the number of devices you own that exchange data with space-based technology. You will depend more on secure connections and data protection than ever before.

The danger you face from space-hacking is much the same as from ground-based communication systems. Staying safe means having effective antivirus software and using a virtual private network (VPN) to encrypt all your confidential data before any third party can access it. In addition to that, there are the usual common-sense measures such as managing privacy settings and learning to recognize attempts at data theft. It’s essential to learn more about personal cybersecurity and regularly check your software for updates.

The future

When it comes to cybersecurity in space, the rational approach is to know that no system is bulletproof. If you build a working satellite system, says James Pavur, “somebody will eventually be able to understand what you do. If it works, it’s probably intuitive at some level, and is thus intuitively exploitable.” Cybersecurity in space, therefore, will continue to be a perpetual arms race between legitimate IT people and hackers. There is no final stage where you reach a permanently secure solution. There are only successive rounds in a never-ending game, where the good guys ensure that any damage done by cyber attackers is kept to a minimum.