Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
Ground Stations a Top Target in Any Future Conflict, Warns Intelligence Official
Space is becoming a domain of warfare, with private sector companies on the front lines – and the first shots will likely be fired in cyberspace, a senior U.S. intelligence official warned this month.
See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It
“Cybersecurity for space systems is very likely to be on the front lines of conflict involving space,” said Johnathon Martin, acting deputy director of the Office of the Chief Architect at the National Reconnaissance Office, which builds, launches and operates U.S. spy satellites.
Physical attacks are always a possibility, but their potential for spiraling out of attackers’ control via the dreaded Kessler effect – a situation in which space collisions produce more debris that provoke more collisions – means cyberattacks are the more likely space weapon, Martin said. That would be especially true of the early stages of a conflict, he said in a keynote address at the annual CyberSat conference in Reston, Virginia.
“The more escalatory actions are, the higher the cost is likely to be imposed back on the actor. Therefore, in conflict extending into space, actors are likely to try to employ the least escalatory measures required to achieve their objectives,” he told the audience of executives and engineers from the space and cybersecurity industries.
Martin’s advice to satellite operators is straightforward: “Your own ground station is the greatest threat to your satellite,” he warned. “If someone owns the ground station, they own the satellite.”
Martin was one of several officials, from the U.S. and other countries, and space executives, who highlighted cybersecurity threats the space industry faces amid growing tensions between democracies in NATO and the European Union and their authoritarian rivals in Russia and China.
Conflict in space is no longer looming; it’s already arrived, said Daniel Hilgert, the senior space coordinator within the defense industry, innovation and armaments division at NATO.
Russia’s campaign of hybrid warfare – acts of sabotage, provocation or disruption below the threshold of armed conflict – against Ukraine’s European allies already extends into space, he said. Hilgert cited jamming of U.S. GPS satellites and Galileo, the EU’s own global positioning satellite constellation. “It’s not just the drones, it’s not just the jets that are violating our airspace, but we also have them in space on a daily basis,” he said.
In an earlier panel, CISOs from several satellite operators discussed the threats they see on a daily basis. Software-defined satellites and multi-orbit architectures – where different constellations communicate among and between each other – open up an expanded attack surface for hackers, said Vinit Duggal, the CISO and vice president for network engineering of European operator SES.
SES’s satellites are “routers in the sky,” connecting different constellations and different networks, he said.
SES has not seen any attacks on, or attempts to take over, its actual spacecraft, Duggal said.
While attacks involving spacecraft may not be happening at the moment, that wasn’t likely to be the case for much longer with increasing strategic competition in the space domain, said Brandon Bailey, a principal engineer at federally funded “think and do” tank Aerospace. Research by Aerospace has found the most common types of cyberattack against space networks to date are “bare minimum, basic” attacks, such as eavesdropping and packet sniffing of unencrypted downlinks or radio frequency jamming.
SES, like other companies, isn’t “seeing a lot of action on the platform itself yet, but we anticipate that changing,” Bailey said.
Concerns about the cybersecurity of U.S. space systems aren’t new. In 2022, Lt. Gen. Stephen N. Whiting, then the head of U.S. Space Operations Command, called cyber “the soft underbelly of these global space networks.”
What’s changing is that U.S allies are coming around, too. German Defense Minister Boris Pistorius in September declared that “our Achilles’ heel lies in space” – and rolled out an unprecedented $41 billion spending plan for space security over the next five years.
“Cyber is a priority focus” when it comes to space security, Florian Göhle, a technical officer with the German Federal Office for Information Security, told the conference.
Although space is a unique environment, the basics of cybersecurity are the same in orbit as on the ground, Göhle said. “We still focus on a security by design approach that says we have to consider security in every phase of the mission, every part of the life cycle.”
Of course, that means assessing the cybersecurity of the supply chain, he said, which in space is international and highly complex.
Assessing supply chain risk, especially for software, means evaluating the trade-offs in “buy versus build,” said Scott McCormick, CSO of Planet Labs, an Earth observation satellite operator. What are the risks and costs of using someone else’s products, rather than designing your own? “We build most of ours,” he said. “So we own it through the whole pipeline. But if you are going to go out and use AWS Ground Stations, or whoever, obviously, understanding the risks and trade-offs is key.”
One speaker argued that the supply chain was already so compromised, only self-built tools could be secure. Michael Bernat, cyber CTO of Israeli defense tech outfit Rafael Advanced Defense Systems, said that his company has invested heavily in building its own, bespoke alternatives to open source or commercially developed hardware elements and software packages.
“By getting known components from off the shelf, we are compromising the entire system,” Bernat said. “And so we started to engineer, and we are investing tons of money in order to have our own components that are not publicly used, in order to minimize the attack surface of our users.”
He added that given the “stupid amount of money,” such measures cost, they were only really cost-effective for the most critical assets.