Download to read offline
Uploaded byWilliam "Bill" Malik, CISA
Satellite talk excerpts
The document discusses security vulnerabilities in satellite communications, highlighting both unintentional threats like collisions and intentional attacks on satellite systems. It mentions the concept of Kessler syndrome, where satellite debris can cause cascading failures, as well as the issues arising from architectural decisions such as the GPS rollover problem that grounded aircraft and disrupted urban networks. The text emphasizes that satellites are susceptible to a range of risks including accidents, attacks, and poor design choices.
Satellite talk excerpts
- 1. Attack Vectors in Orbit: SatelliteSecurity William J. Malik, CISA VP Infrastructure Strategies
- 2.
- 3. © 2019 TrendMicro Inc.3 Vulnerabilities - Notes The essential elements of a satellite communications system are shown, with the vulnerabilities highlighted in grey, and black. This simplified chart omits any additional satellites, such as ones used as intermediate relays, for instance. Satellites are vulnerable to physical attacks or mishaps, as are ground stations. The signal a satellite is broadcasting can be hijacked (replaced with another signal, like the Max Headroom prank in Chicago). The control system can be subverted, allowing a malicious actor to move the satellite or disable it, and the signal can be jammed. Specific measures can defeat some of these attacks. In 2002 following a series of satellite failures the GAO reported on satellite vulnerabilities. They produced two charts: one showing unintentional threats, the other showing intentional threats.
- 4. © 2019 TrendMicro Inc.4 Unintentional Threats to Satellites
- 5. © 2019 TrendMicro Inc.5 Unintentional Threats - Notes Unintentional threats to satellites are accidents that can damage the satellite or its ground station. These include meteorites, solar wind, accidental collisions, and all the things that can go wrong when a complex system is in a hostile environment. None of these is planned, or caused by a human actor.
- 6. © 2019 TrendMicro Inc.6 Intentional Threats to Satellites
- 7. © 2019 TrendMicro Inc.7 Intentional Threats - Notes Intentional threats are hostile, planned attacks on the satellite, its payload, or its ground station. All of these require some measure of planning and resources to succeed. The GAO report goes into detail examining the best measures to thwart these attacks. But there is an additional classes of problems that are neither unintentional nor intentional: unwise architectural decisions and code defects. Let’s look at both.
- 8.
- 9. © 2019 TrendMicro Inc.9 Kessler Syndrome Notes Kessler Syndrome was first described in the 1970s by Donald Kessler, Senior Scientist for Orbital Debris Research at NASA. He speculated that when a satellite disintegrated the shrapnel could cause additional satellite failures, generating more debris. This “collisional cascading” would continue until the satellites in the orbit were all disabled and that orbit had to be abandoned. In 2009 the Socrates system predicted that two satellites would pass within 564 meters. One was a defunct Soviet-era communications satellite, the other was number 33 of the Iridium communications constellation. In reality they collided. The problem here was either a code bug: the location data was accurate but the calculation was performed incorrectly; or a user interfaced bug: the position and trajectory data was not precise but the programmer performed the calculation anyway, inventing precision. If the data was imprecise, the answer should have been, These two satellites will pass within 1/2 km, head’s up. https://www.nasa.gov/centers/wstf/site_tour/remote_hypervelocity_test_laboratory/micrometeo roid_and_orbital_debris.html
- 10. © 2019 TrendMicro Inc.10 GPS Rollover Multiple Boeing 787s in China experienced GPS 20 years rollover issue. Some aircrafts have to be grounded waiting for an update. – China Aviation Review NYCWiN crashed 7:59 PM Apr 6 – NY Times
- 11. © 2019 TrendMicro Inc.11 GPS Counter Rollover - Notes Satellites launched before 2010 used a 10-bit field to count the weeks since Jan 1, 1980. This count contributes to the satellite determining its position. Since there are 52 weeks in a year, that counter rolls over in less than 20 years. This unwise architectural decision was not an unintentional act nor a deliberate attack. But the impact was felt by Boeing’s 787 jets in China Air, which were not certified as airworthy when they reported today’s date as Aug 22, 1999; and by New York City’s NYCWiN WiFi network, which crashed at 7:59 PM EST April 5, 2019. That system was down for ten days. The outage meant the 12,000 automatic traffic signals could not count traffic, so defaulted to a regular 90-second green, 15 second yellow, 90 second red pattern. This slowed traffic. Also, the 300 kiosks offering free public Internet access were unavailable. New York spent $330 million setting up the system and pays $50 million a year for ongoing support and maintenance. This unwise architectural choice ignored the operational longevity of satellites. Telstra, launched July 10 1962, is still in orbit today. IoT devices, such as satellites, are subject to accidents, malicious attacks, and bad design and implementation choices.
Editor's Notes
- #2 Already a vital part of both the internet of things and the critical infrastructure of the internet, satellites are set to take on a more significant role with the emergence of 5G cellular network technology and the continuing expansion of the internet of things (IoT). Because satellites are intended to be “dumb pipe” transmission methods meant to counter geography-related or economic issues, the radio-related security in most of them is minimal. Also, most satellites are more than five years old and lack the means of patching vulnerabilities discovered since they were launched. Much of the security that did make it into orbit was the result of standards-based auditing, lacking radio hardening — meaning the only way of reaching most satellites in space is the least secure method. This session will provide three satellite attack scenarios that could occur without increased cyber security measures and discuss viable solutions to this threat. The presenter will outline the following scenarios: False earth station – Satellites are controlled from the ground through earth or base stations. If the authentication between the earth station and the satellite is poor or nonexistent, an attacker can gain control of the satellite or its transmitted payload. Evil satellite twin – A criminal setup or device located at altitude, such as the belly of a drone, can broadcast information as though it came from a legitimate source. The expected action based on satellite information would then be easily manipulated, resulting in situations such as GPS creating gridlock on a highway or a television broadcast being overwritten with terrorist propaganda. Inter-satellite trust – Satellites are often part of mesh networks in which they trust one another, allowing other satellites in the network to sit with their security perimeter. Since satellites are usually unhardened to radio, posing as a member of the network grants easy access to it. The speaker will emphasize why the security community must consider the older connected devices and nodes that put the entire IoT ecosystem at risk. He will describe ways to determine whether attendees’ networks are at risk. The session will end with an open discussion around technologies that may have the potential to help solve these challenges.
- #3 This is our model for a satellite system. It is simplified because the satellite talks directly to the ground station. The vulnerabilities are indicated in grey, and in black. Ground stations can lose power, control stations can be hijacked (taking over control of the satellite’s position and behavior) Point solar panels directly at sun, overloading battery Redirect comms antenna to spoofed Communications links can be subverted (intercepting or replacing content – meconing, comms intercepting, ) Antennae can be overloaded – jammed And don’t forget that the GPS encoding on satellite time stamps rely on a 10-bit week (1,024 weeks) which rolls over on April 6 2019. Y2K returns. Update microcode/software accordingly.
- #5 Bad things that can happen (a bad actor can mimic some of these impacts) Note the absence of any kind of software defect from the list. Yet, GPS satellites are facing a Y2K-like problem right now. They have a 10-bit counter incrementing each week since Jan 1 1980. Every 1024 weeks – 19 years and 36 weeks. On April 6 2019 that counter will roll over. Any satellite in service since 1999 that doesn’t have the patch to support a 13-bit week will roll over, meaning the satellite will report its position incorrectly. Many satellites do not have the ability to update their firmware (software load). These will have to be deactivated, or their signals will DDoS earth-born receivers. Note also that other classes of s/w defects are absent. On February 10, 2009, two artificial satellites, Iridium 33 and Kosmos-2251, accidentally collided at a speed of 11,700 m/s and an altitude of 789 kilometres above the Taymyr Peninsula in Siberia. They were being tracked by Socrates, and expected to pass 564 meters from each other.
- #7 Note that satellites, coming from the OT world, do not have a category for exploitation of unpatched software defects. The are lumped into the category of cyberattacks.
- #9 https://www.wired.com/story/the-space-junk-problem-is-about-to-get-a-whole-lot-gnarlier/ Kessler was an astrophysicist at NASA who realized in 1978 that space junk in LEO had an increasing likelihood of colliding with active satellites and destroying them, in a possibly cascading series of chain reactions rendering a significant part of the LEO range useless. Hunter-killer satellites could remove space junk (a la Gravity, Sandra Bullock and George Clooney) Hackers could maliciously start such a chain reaction by taking over a satellite and steering it. In the US, two governmental offices share that daunting task: a NASA group and the military’s US Strategic Command—USSTRATCOM, if you feel like yelling an acronym that will automatically make you sound like a sergeant—keeps track of 24,000 objects, down to about 10 centimeters in size. Some 18,700 of these are publicly listed at Space Track (the rest are for the Department of Defense to know and you never to find out). https://www.theregister.co.uk/2019/02/11/happy_satellite_collision_day/ Onn Feb 10. 2009, the defunct 16-year-old Russian satellite Cosmos 2251 hit the Iridium 33 communications satellite, creating about 2,000 pieces of debris over 1 cm in size. It was expected they would pass 584 meters apart … http://celestrak.com/events/collision/
- #11 April 6, 2019, came and went, and, as in 1999, no planes fell out of the sky. But several planes had to stay on the ground. China Aviation Review tweeted round a photo of what purports to be a cockpit console screen reading "22 AUG 1999," which you may remember was the date of the previous GPS rollover. "Multiple Boeing 787s in China experienced GPS 20 years rollover issue. Some aircrafts have to be grounded waiting for an update," the tweet read. We haven't been able to confirm that, although Sean Gallagher at Ars Technica did confirm that the Chinese flight in the photo was delayed by four and a half hours. We also saw a report from SimpleFlying.com that "at least 15" 787s in China were grounded as result of the rollover, and a Reddit thread that said a KLM flight from Amsterdam to Bogota on April 7 was grounded due to "something to do with the data being wrong." But we can confirm that New York City's own government-use wireless network, NYCWiN, crashed at 7:59 p.m. Eastern time April 6, exactly when the GPS rollover took place, according to the New York Times. The system was restored ten days later, April 16, 2019. "Elements of our private wireless network have been disrupted by a worldwide GPS system update," the city's Department of Information Technology and Telecommunications said on April10, according to the New York Daily News. NYCWiN uses "377 transmitters" spread out "over 300 square miles across five boroughs" to give city agencies, including the police, fire and transportation departments "real-time access to high-speed voice, video, and data communications," according to the description on the city's official website. Since the system down during the rollover, traffic lights have not been able to sync up in order to maximize traffic flow, and police-car mounted cameras haven't been able to upload footage, according to the New York Post. The NYPD doesn’t rely on NYCWiN but uses Verizon cellphones instead. The city apparently pays Northrop Grumman, one of the country's premier defense contractors, about $37 million yearly to keep the system up and running. NYCWiN initially went online in 2009 and cost $500 million to build out. "We are testing the equipment right now and expect to have NYCWiN back up this weekend," a city spokeswoman told the New York Post. IN fact it was the subsequent Tuesday, April 16, when it came back on-line.