Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
Satellites Will Be Newest Cyberwar Front
Now that space is becoming a battlefield, cyberwar will be waged there, experts predict, and the race is on to develop cyber defenses that can protect new satellite constellations from foreign cyber-warriors, online spies and even criminal hacker gangs.
See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime
The problem is that conventional cybersecurity tools mostly don’t work in orbit. Space is an unforgiving environment, with traditionally unique hardware and no room for uncertainty or even latency, both of which are characteristic of conventional cybersecurity tools. Intrusion detection and response looks very different in the various proprietary on-orbit network environments created by the new low earth orbit mega-constellations like Starlink and Amazon LEO.
Even indicators of compromise, the most basic coin of cyber defense, don’t work well on orbit, experts told ISMG.
The Department of Homeland Security’s Science and Technology Division, the federally-funded research and development non-profit Aerospace Corporation, technology contractor Deloitte and U.S. Space Force contractors Proof Labs, BigBear.ai and Redwire Space Systems are all working to develop cybersecurity tools designed to identify, and in some cases repel, hostile cyber activities in onboard software.
They are in a race against time, said Sam Visner, a former senior U.S. official who now chairs the Space Information Sharing and Analysis Center, a not-for-profit membership association that shares threat and hazard information among space sector companies.
“There is a convergence of the space and cyber domains,” he told ISMG in an interview. The space sector had historically enjoyed strong norms and legal agreements barring attacks on satellites and other spacecraft. The U.S., Russia and other space powers tested and demonstrated anti-satellite capabilities, Visner said, “but we did not actually shoot at other people’s space systems. … That was a red line.”
As space and cyber domains converged, each becoming more dependent on the other, those norms are eroding, “Historically, normative behavior in cyber really doesn’t exist, … There aren’t many consequences to attacking in cyberspace,” he said.
“Physical attacks against space systems, knock on wood, are still prevented more or less by normative behavior, … but cyberattacks are increasing,” Visner added, noting the continual jamming and spoofing of GPS and the fact that the first act of war in the Russians’ full-scale invasion of Ukraine in 2022 had been a cyberattack on a U.S. commercial satellite system, Viasat.
The commercial space sector must gird itself to defend against cyberattacks, Visner said. “We are going to need more technological and operational measures detecting intrusions, rejecting them, detecting anomalous behavior, determining whether or not that anomalous behavior is a result of an intrusion, building space system architectures that are more able to defend against these intrusions.”
It’s a problem set that a small number of satellite engineers have been wrestling with for years. The very limited size, weight and power available for devices deployed into space is an issue. Onboard operating systems are mission critical and require deterministic outcomes. In some ways, they mirror the idiosyncrasies of ICS/OT systems and their operators are likewise reluctant to make their exquisite technology into guinea pigs for unproven security upgrades.
As a result, there was an “onboard detection gap,” said Ernest Wong, the technical lead for space systems at DHS’s Science and Technology Division. Satellite operators currently rely on telemetry – signals from the satellites beamed to its ground station – to detect possible cyberattacks.
One of the biggest challenges, Wong told ISMG, is the very different hardware and software environment in orbit. “Unlike on enterprise terrestrial networks, which usually run on Windows or Linux, satellites and spacecraft run on a number of different platforms, operating systems, flight software, and bus architectures,” he said. It isn’t always straightforward knowing what to look for to detect an attack in progress.
“This makes creating a singular ‘signature’ as an IOC more complicated. … Additionally, the lack of on-board detection may also limit our visibility into compromises.”
IOCs generally become available only after an attack. For space systems, most attacks would be novel and there is no history of prior software vulnerabilities to be mined for clues. That;’s DHS S&T, in partnership with the Aerospace Corporation, to develop an alternate gage of attack: indicators of behavior. An IOB is an indicator of a cyberattack in the real world, looking for anomalous behavior in the satellite or its onboard payloads.
An IOB is malware-agnostic. “If you can detect various categories of malicious behavior, that can also potentially detect future unknown exploits,” Wong said.
To leverage IOBs, and provide commercial satellite operators with a cybersecurity tool they could use onboard, S&T and Aerospace last year built SpaceCOP, a software package that could detect and possibly repel hostile cyber activity onboard.
Ten commercial partners are tinkering with SpaceCOP, said Brandon Bailey, principal engineer for space cybersecurity at the Aerospace Corp. The plan is to open source it later this year.
The next step after SpaceCOP, Wong said, will be developing autonomous response tools – software that could not just detect an intrusion or other attack but act automatically to block or expel it. The huge scale of the new LEO mega-constellations, with thousands or tens of thousands of satellites in orbit, plus the fact that LEO satellites wink in and out of view of their ground stations means that “some level of automated response will be needed to make defensive cyber operations manageable,” Wong said
To help make automated response a reality, S&T has also been working on how to provide sharable cyber threat intelligence in a machine readable way using the structured threat information expression format. Space-ISAC is leading a working group of the OASIS Cyber Threat Intelligence Technical Committee, which manages the STIX standard, to work on a specially adapted version for the space industry.
Meanwhile, U.S. Space Force contractor Proof Labs is building an AI-powered tool, the Cyber Resilience On-Orbit program, which uses machine learning to spot anomalous behavior by the satellite or its payload from the ground. The AI model is being trained using high-fidelity synthetic satellite telemetry and other data, which is compiled by BigBear.ai using a digital model built by Redwire Space Systems. It will be available to military and civilian customers this year, said Dick Wilkinson, cofounder and chief technology officer of Proof Labs.
The only cyber tool actually on orbit right now is Silent Shield, built by consultancy giant Deloitte, said Ryan Roberts, a principal at the firm. The company launched Deloitte-1, the first of a planned nine-strong constellation, into orbit last year from Vandenberg Space Force base. In addition to its operational RF collection payload, the 22 pound, microwave oven-sized cubesat also carries a prototype on-orbit intrusion detection system, dubbed Silent Shield.
To ensure the cyber tool doesn’t interfere with the operation of the satellite, Silent Shield is out-of-band, explained Roberts. It is set behind a one-way diode and able to receive data so it can monitor the satellite’s outputs and performance, but not able to feed anything back into the satellite’s operating or payload software.
Deloitte cyber operators have been launching a series of 40 increasingly sophisticated cyberattacks against the satellite, to see whether Silent Shield will successfully detect them. So far it’s found them all, Roberts told ISMG in an interview.
This year, the company has launched two more satellites, Deloitte-2 and -3. Having proved out the concept of Silent Shield, the next step is to show that the capability can be added to existing satellites already on orbit. “We want to demonstrate how you can add cyber protections to a legacy satellite,” Roberts said. To this end neither of the two newest birds have Silent Shield preinstalled. Instead it will be uploaded to them, showing that the tool can be installed on birds already in orbit via software updates.
The small constellation is flying in “a cluster or a ball,” said Roberts, not only to support its operational missions, but also because Deloitte is testing inter-satellite communication links. “We also want to demonstrate the ability to laterally move from one satellite to another through the ground segment, because that is the sort of TTP that might be leveraged” by an advanced adversary.