Satellites Are Rife With Basic Security Flaws

Comments

• echo64@lemmy.world ⁨1⁩ ⁨year⁩ ago

  If they’re surprised that satellites a launched with security flaws and never patched, wait until they learn about literally everything else we’ve ever made

  source

  • spacedancer@lemmy.world ⁨1⁩ ⁨year⁩ ago

    The S in IoT stands for Security.

    source

    • Marsupial@quokk.au ⁨1⁩ ⁨year⁩ ago

      Internet of ThingSecurity?

      source
    • Gutless2615@ttrpg.network ⁨1⁩ ⁨year⁩ ago

      Stealing the hell out of that.

      source
  • fmstrat@lemmy.nowsci.com ⁨1⁩ ⁨year⁩ ago

    On a good note, it looks like the firmware was handed over to researchers to find these types of issues. So it was proactive.

    source
• caesar_salad83@lemmy.world ⁨1⁩ ⁨year⁩ ago

  What people don’t understand is that satellies don’t run traditional OS. They run simple state machine firmares and real-time software. Also, you don’t interact with them with something like a command line and general shell commands. So even if a bug or vulnerability were to be found in some library, driver or firmware and it’s far from a vector for attack.

  A way more plausible way of gaining control is to attack the ground equipment. Anothr method will be learning the command and telemetry dictionary by careful observation of the communication (not trivial, but lets assume possible).

  Now you have the problem of what to do with the control. The usual fanciful doomsday scenario is diverting the satellite to hit another one. this is extremely unlikely, manoeuvring satellites isn’t like making a car take a turn, it take careful planning and execution. Even then it’s not fast, the other satellite operator can see it coming and do a small manoeuver to be able to dodge. On top of all that, lots of nano and small satellites have a very limited propulsion system if at all.

  The other alternative is to hurt it’s ability to operate, which is a way more easy. But again, there are simpler and easier ways to that - mostly by jamming and disrupting communication.

  In conclusion, not that I think cyber security in satellites shouldn’t be a thing, but that article, based on an academic study of the code of 3 firmwares from amateur to research level small-sats, doesn’t impress me much.

  source

  • Wintermute@lemmy.villa-straylight.social ⁨1⁩ ⁨year⁩ ago

    Are you speaking from first hand experience? I don’t have experience with commercial satellites, but I can say from direct experience that scientific satellites and other spacecraft absolutely run a (real-time) traditional OS these days (and even a decade ago). I don’t think I want to say any more than that given the nature of the discussion.

    source

    • caesar_salad83@lemmy.world ⁨1⁩ ⁨year⁩ ago

      I guess I wasn’t clear, real time OS absolutely are in use (I just said real-time software). my point was that they aren’t the same as what most people know and experience. attacking them isn’t like attacking some random IoT device or “hacking” some random server or PC.

      In my experience, people don’t have a good idea of how satellites operate and articles like this one don’t help.

      source
  • CheeseNoodle@lemmy.world ⁨1⁩ ⁨year⁩ ago

    I think the worst thing you could do if gaining control of a satellite would be to attempt to use it as a kinetic kill vehicle, after all buildings can’t dodge and the trajectory calculation is relatively trivial by todays standards, especially since you can take your time figuring it out long in advance.

    source

    • caesar_salad83@lemmy.world ⁨1⁩ ⁨year⁩ ago

      This became too long for me to grammar and spell check… apologies in advance.

      If you are talking about raining satellites down on earth, rods from god style, than I can assure you the risk is theortic at best.

      Lets, as it’s said, start from the beginning. In order for a satellite to hit the surface of earth, it has to be big enough, massive enough and dense enough. Not a lot of satellites are in that category. probably non that can be turned into a proper kinetic energy weapon.

      Then it needs the right trajectory. Too shallow and the speed fall will be gradual, the satellite will break up to small bits that will, in the worst case, fall out of the sky in their respective terminal velocity. Too steep of a trajectory and it will burn it’s self completely.

      Now lets say we have the perfect satellite and the perfect trajectory for reaching the target, on top of it being vulnerable to cyber attack. We reach the biggest hurdle - fuel. Satellite don’t carry as much as you might think. The stuff is heavy and expensive. Satellites will typically use a lot of their fuel in their initial orbit insertion or will carry only what is needed to keep their said orbit as long as their mission dictates. Why is that important? because big changes in a satellite orbit are very costly in terms of energy, i.e. fuel.

      Ok, ok, lets pretend we have a satellite with all the above criteria and has enough fuel. Now we need to make the manoeuver. oops, the satellite engines can’t make it in one go. see, satellites use small thrusters to do most of their manoeuvring, as they mostly do station keeping or small orbital changes. So now we’re talking about a series of maneuvers in order to carry out the deadly plan. and do it without the original owners getting control back.

      But what if it did happen, you ask. Then I have more bad news. The satellite will be tracked, it’s trajectory calculated and a warning would be issued. The damage would be light, but will generate lots of headlines.

      source
• DharkStare@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Reading this article made me wonder if a satellite can be turned off and then back on. I’ve never really thought about how satellites are maintained and serviced. You can’t exactly send IT up there to fix things.

  source

  • rtxn@lemmy.world ⁨1⁩ ⁨year⁩ ago

    When the satellite hits you with /sbin/init does not exist. Bailing out, you are on your own now. Good luck.

    source

    • masterofn001@lemmy.ca ⁨1⁩ ⁨year⁩ ago

      Linux has some dead pan humour system failure messages. Keeps things fun when everything goes to shit.

      I did hit that one once. Or twice.

      source

      • -> View More Comments
    • roi@lemmy.blahaj.zone ⁨1⁩ ⁨year⁩ ago

      The horror

      source
  • ramielrowe@lemmy.world ⁨1⁩ ⁨year⁩ ago

    At it’s most basic, a satellite will have two systems. A highly robust command and control system with a fairly omnidirectional antenna. And then the more complex system that handles the payload(s). So yea, if the payload system crashes, you can restart it via C&C.

    source
  • deaconblue@kbin.social ⁨1⁩ ⁨year⁩ ago

    But if you could that is absolutely the first thing that they would try, turn it off and then back on

    source
  • 14th_cylon@lemm.ee ⁨1⁩ ⁨year⁩ ago

    I’ve never really thought about how satellites are maintained and serviced.

    rarely and costly. one example is www.nasa.gov/content/hubbles-mirror-flaw

    source
  • HubertManne@kbin.social ⁨1⁩ ⁨year⁩ ago

    nasa seems to reboot things so I don't see why not. When they do though I think its really nail biting while they hope to hear from it again when it boots up.

    source
• wombat27@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Paywall removed if over free article limit;

  12ft.io/proxy?q=https%3A%2F%2Fwww.wired.com%2Fsto…

  source
• Kolanaki@yiffit.net ⁨1⁩ ⁨year⁩ ago

  Time to hack some satellites

  source

  • pseudorandom@kbin.social ⁨1⁩ ⁨year⁩ ago

    Hack the planet!

    source
• Ogmios@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Computers in general are fundamentally insecure. People really ought to stop trying to move everything digital, else we’re setting ourselves up for a really bad time.

  source

  • FuglyDuck@lemmy.world ⁨1⁩ ⁨year⁩ ago

    They were dumb enough to share their firmware when asked.

    Cyber security isn’t a concern they have. Either they’re just idiots, or they feel confident nobody is interested in exploiting things, and thought it might be “interesting” to see what they have to say.

    I would assume the secret spy satellites and rods-from-god-dropper have better security….

    source