Interstellar Intruders

Hijacking Satellites through Firmware Vulnerabilities

Johannes Willbold

@jwillbold

/jwillbold

$whoami

  • Satellite & Space Systems Security
  • Doctoral Student
    • Ruhr University Bochum, DE
  • Visiting Researcher
    • Cyber-Defence Campus, CH
  • General Chair @ SpaceSec Workshop
  • Subgroup Chair @ IEEE SA Space System Cybersecurity Working Group
  • Hack-a-Sat 2 & 4 Finals

Space Odyssey

44th IEEE Symposium on Security and Privacy (S&P)

Distinguished Paper Award

Applications

Telecommunications

Research

Technology Testing

Global Positioning

Earth Obervation

 Context

Space Segment

34 cm

10 cm

3U CubeSat

ISL

 Context

Ground Segment

Space Segment

ISL

 Context

Ground Segment

Space Segment

ISL

Space Protocol

 Context

User Segment

Ground Segment

Space Segment

ISL

Space Protocol

Firmware Attacks

Our Journey ...

Survey

System Analysis

Attacker Perspective

Firmware Attacks

ViaSat Incident

Ground Segment

Space Segment

User Segment

Firmware Attacks

Ground Segment

Space Segment

Attackers

?

Not so Novel

Outdated Assumptions

Myth of Inaccessibility

$$$ → $

Affordable Ground Stations

Ground Station as a Service
GSaaS

More Satellites
GEO → LEO

Security by Obscurity

No Insights <=> No Attacker

Security by Obscurity

No Insights <=> No Attacker

Commercial off-the-Shelf (COTS)
Components

Higher Stakes
Critical Infrastructure

More Developers

More People Involved

Attacker Goals

Denial of Service

Malicious Data Interaction

Seizure of Control

Attacker Goals

Seizure of Control

Components

Payload

Bus

?

Components

COM

Payload

CDHS

EPS

ADCS

TC / TM Flow

COM

Payload

CDHS

Telecommand (TC)

Telemetry (TM)

  • Decode
  • Authenticate
  • Repackage
  • Parse
  • Execute
  • Respond

EPS

ADCS

COM

PDHS

CDHS

  • Decode
  • Authenticate
  • Repackage
  • Parse
  • Execute
  • Respond

EPS

ADCS

PLCOM

TC / TM Flow

Payload Traffic

TC / TM Traffic

Attack Path

PDHS

PLCOM

COM

CDHS

Bus

Attack Path

PDHS

PLCOM

  • Hack CySat 2022 & 2023
  • CySat 202

COM

CDHS

Bus

Attack Path

  • Bypass COM Protection
    • Missing AC
    • Insecure Protocol
    • Outdated Crypto
    • Timing Side Channels
    • Leaked Keys
    • Timed Backdoor
    • ...

COM

CDHS

Bus

Attack Path

  • Bypass COM Protection
    • [...]

COM

CDHS

  • Deploy Attacker Payload
    • Firmware Update
      • Signed Image
      • Slow Upload
      • Complex System

Bus

Attack Path

  • Bypass COM Protection
    • [...]

COM

CDHS

Bus

  • Deploy Attacker Payload
    • Firmware Update
    • Dangerous TC
    • Vulnerable TC
  • Hijack Bus Control Flow
  • Full Bus Privileges

 Objectives

1

2

3

4

Bypass COM Protection

Dangerous / Vulnerable TC

Hijack Bus Control Flow

Full Bus Privileges

Satellite Case Studies

Approach

System Design

Protocols

ESTCube-1

ESTCube-1

ESTCube-1

Peripherals

E-Sail (E. Solar Wind Sail) Propulsion

Bus Platform

ARM STM32

Developed by University of Tartau

Custom Protocol

Sender Subsystem ID

Recipient Subsystem ID

Flow Control Flags

Inner Payload

Fletcher-16 Checksum

TX seq.

RX seq.

COM

ID Subsystem
0 EPS
1 COM
2 CDHS
...
5 Ground Station
bit 0 bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7
Byte 0
Byte 1
Byte 2
Byte 3
...

Command Identifier (MSB)

Command Identifier (LSB)

Source

Block ID

Length

Args

Security Analysis

  • Bypass COM Protection
    • Missing TC Protection

COM

CDHS

Security Analysis

  • Bypass COM Protection
    • Missing TC Protection

COM

CDHS

int sch_handler_set_raw_memory(scheduler_cmd_t* pCmd) {
  raw_mem_access_cmd_t* pAddr = pCmd−>pCmdArgs;
  char* pWriteData;

  if (pAddr) {
    if (g_sch_exec_mode != 1 ) { 
      /* exception and return */ 
    }
    char* pWriteData = &pAddr−>start_of_data_buf;
    if (pAddr−>filesystem_target) {
      // [...]
    } else {
      memcpy(pAddr−>targetAddr, 
             &pAddr−>start_of_data_buf, 
             pAddr−>writeLength);
    }
  }
  // ...
}

Real-World Test

  • Bypass COM Protection
    • Missing TC Protection

COM

CDHS

  • Deploy Attacker Payload
    • Dangerous TC

Image Source: Maximilian Gerhardt, Reverse Engineering Satellite Firmware for Security Evaluation, 13. Dec. 2021

Real-World Test

  • Bypass COM Protection
    • Missing TC Protection

COM

CDHS

  • Deploy Attacker Payload
    • Dangerous TC

Bus

  • Hijack Bus Control Flow
    • ?
  • Full Bus Privileges
    • ?

OPS-Sat

System Chart

Experimenter

Operated by ESA

Open for Research

Peripherals

S-/X-Band, SDR, Optical Rx., Camera, ...

System Chart

2

3

CCSDS Protocol Stack

2

AVR32 AT32UTC3, FreeRTOS

1

3

1

Cubesat Space Protocol (CSP)

 UHF-Stack

/ libcsp

Cubesat Space Protocol (CSP) v1

Source: https://en.wikipedia.org/wiki/Cubesat_Space_Protocol

TCP/IP Oriented Design

Cubesat Space Protocol (CSP) v1

1

 UHF-Stack

Cubesat Space Protocol (CSP) v1

  • HMAC-SHA1 Authentication
  • XTEA Encryption Support

Security Issues

  1. MAC comparison leaks timing data #44
    • memcmp to compare the digest
  2. HMAC doesn't protect headers #45
    • Same problem for the CRC checks
  3.  XTEA encrypt packet nonce too predictable #162
    • const uint32_t nonce = (uint32_t)rand();

Authors: Issues fixed in libcsp v2

Security Features

1

 UHF-Stack

Cubesat Space Protocol (CSP) v1

  • HMAC-SHA1 Authentication
  • XTEA Encryption Support

Security Issues

  1. MAC comparison leaks timing data #44
    • memcmp to compare the digest
  2. HMAC doesn't protect headers #45
    • Same problem for the CRC checks
  3.  XTEA encrypt packet nonce too predictable #162
    • const uint32_t nonce = (uint32_t)rand();

Authors: Issues fixed in libcsp v2

Security Features

1

System Chart

3

CCSDS Protocol Stack

3

2

AVR32 AT32UTC3, FreeRTOS

2

CCSDS - Protocol Stack

S-Band Stack

Space Packet Protocol

IP

Sync. and Channel Coding Sublayer

Message Abstraction

...

IPSec

TM Space Link Protocol

TC Space Link Protocol

AOS Space Data Link P.

Proximity-1

Data Link Lay.

3

CCSDS - Protocol Stack

S-Band Stack

Space Packet Protocol

IP

Sync. and Channel Coding Sublayer

Message Abstraction

...

IPSec

TM Space Link Protocol

TC Space Link Protocol

AOS Space Data Link P.

Proximity-1

Data Link Lay.

3

Unprotected TCs

int csp_route_security_chek(...) {
  if (packet->id.flags & CSP_FXTEA) {
    csp_log_error("Received XTEA encrypted packet, but CSP was compiled without XTEA support. Discarding packet");
  }
  
  // ...
  
  if (packet->id.flags & CSP_FHMAC) {
    csp_log_error("Received packet with HMAC, but CSP was compiled without HMAC support. Discarding packet");
  }
  
   // ...
}

COM

Unprotected TCs

  • Bypass COM Protection
    • Missing TC Protection

COM

CDHS

int sch_handler_set_raw_memory(scheduler_cmd_t* pCmd) {
  raw_mem_access_cmd_t* pAddr = pCmd−>pCmdArgs;
  char* pWriteData;

  if (pAddr) {
    if (g_sch_exec_mode != 1 ) { 
      /* exception and return */ 
    }
    char* pWriteData = &pAddr−>start_of_data_buf;
    if (pAddr−>filesystem_target) {
      // [...]
    } else {
      memcpy(pAddr−>targetAddr, 
             &pAddr−>start_of_data_buf, 
             pAddr−>writeLength);
    }
  }
  // ...
}
void task_adcs_servr() {
  char log_file_name [32];

  csp_listen(socket, 10);
  csp_bind(socket, port);
  
  do {
    do {
      conn = csp_accept(socket, 0xff);
    } while (do_wait_for_conn);
    
    packet = csp_read(conn, 10);
    if (packet) {
      packet_data = packet->data;
      switch(*packet_data) {
        // [...]
        case SET_LOGFILE: {
          packet_data = packet->data + 0xf;
          log_file_name[0] = '\0';
          strcat(log_file_name,packet_data);
          // ...
        }
      }
    }
  }
}

Vulnerable TC

ADCS Server

Cubesat Space Protocol (CSP)

Defenses - 404?

  • Bypass COM Protection
    • Missing TC Protection

COM

CDHS

  • Deploy Attacker Payload
    • Vulnerable TC

Bus

  • Hijack Bus Control Flow
  • Full Bus Privileges
  • No OS-Defenses
    • ASLR
    • NX Stack
  • No SW-Defenses
    • Stack Cookies
  • Privilege-free RTOS

Flying Laptop

Flying Laptop

Peripherals

De-orbit mechanism, AIS, Camera, etc...

Bus Platform

SPARC LEON 3 - OBC from Airbus S&D

Technology Tester

Co-Developed by
Airbus Space & Defense

CCSDS

Space Packet Protocol

IP

Sync. and Channel Coding Sublayer

Custom

...

IPSec

TM Space Link Protocol

TC Space Link Protocol

AOS Space Data Link P.

Proximity-1

Data Link Lay.

Bigger Picture

But it's different for [...] satellites.

But it's different for [...] satellites,
.... right?

Developer Survey

 TC Protocols

Custom

Standard

Weight

~ 1.3 kg

~ 5.4 kg

~ 120 kg

Weight ≈ Money

 TC Protocols

Custom / Standard

Weight ≈ Money

1-50 kg 50-100 kg > 100 kg
Standard 1 1 4
Custom 6 1 0
Abstains 3 0 1
∑ 10 2 5

=> Inaccessible Standard

 TC Protocols

Inaccessible Standard

"Guideline" Standards

Few Open-Source Implementations

No Best Practices

Unknown Requirements

Grown over Decades

TC Protection

Question: Are any measures deployed to prevent 3rd parties from controlling your satellite?

Unknown*:

Prefer not to say / Don't know

2

4

6

8

9

3

5

Yes

No

Unknown*

 TC Obscurity

Question: What measures are deployed to prevent 3rd parties from controlling your satellite? (Multiple Answers)

2

4

4

5

Access Control

Encryption

3

*: Special knowledge about ....

Special permit needed

* ... Frequences, Modulation, etc.

* ... Protocols

3

2

 Challenges

Security by Obscurity

Emergency Recovery

Technical Challenges

Security Testing

Question: Which, if any, methods, tools or techniques were used to ensure/improve code quality? (Multiple Answers Possible)

5

1

14

Penetration Testing

Bounded Model Checking

2

Hardware/Software in the Loop

Unit Testing

10

14

Fuzzing

But it's different for *my* satellite

Impact

1. Hack a Satellite

2.   ???

 Scenarios

Orbital Access

1

Attacking Inter-Sat Links

2

Orbital Traffic Interception

3

Orbital Denial-of-Service

Kessler Syndrome

4

Attacker Perspective

Hack-a-Sat

Math? Math!

Lesson Learnt

Lessons Learnt

Firmware Attacks on Satellites are a Thing

ViaSat Incident != Satellite Firmware Attack

Common Sat Protocols lack Security

Security by Obscurity

Lessons Learnt

Missing State-of-the-Art Defenses

Attacker Access to Orbit as Staging Ground

Unknown Consequences

Missing TC Protection

Thanks!

  • Firmware Attacks on Satellite
  • Satellite Exploitation Objectives
  • Three Satellite Case Studies
  • Satellite Developer Survey
  • Impact beyond Vulnerable Satellites

@jwillbold

/jwillbold

Johannes Willbold - johannes.willbold@rub.de

[1] ESTCube-1 Image: https://www.eoportal.org/satellite-missions/estcube-1

[2] OPS-Sat Image: https://www.esa.int/ESA_Multimedia/Videos/2019/12/OPS-SAT_ESA_s_flying_lab_open_to_all

[3] Flying Laptop Image: https://www.irs.uni-stuttgart.de/en/research/satellitetechnology-and-instruments/smallsatelliteprogram/flying-laptop/