Why Space Security Is a Career Opportunity

▶ Watch (4:54)

Space is fundamental to civilization. GPS provides positioning, navigation, and timing. Every Fortune 500 company now has a space strategy. Launching a 50-kilogram satellite costs $300,000. 55 YC-funded startups build in space for mineral exploration, tourism, and communications. SpaceX still uses C and C++ for flight software, not Rust or Go. Security engineers can shift from cloud or appsec to space roles. The talent shortage is massive.

Real Attacks: Wiper Code and Truck-Mounted Jammers

▶ Watch (9:09)

In 2022, the KA-SAT network suffered a wiper attack. Malware overwrote flash memory on Viasat modems. The attack disrupted Ukrainian military command and control. It also knocked out German wind turbine monitoring and European residential internet. The malware, AcidRain, was attributed to a Russian APT group. Iran uses truck-mounted jammers between 20 and 30 miles to block Starlink uploads. Starlink countered with a null-steering software update that creates blind spots for jamming signals.

Space Segments and Protocol Vulnerabilities

▶ Watch (24:26)

Space systems have four segments: space, ground, link, and user. The link segment includes uplink, downlink, and crosslink between satellites. Starlink satellites talk to each other in a mesh network. CCSDS defines space protocols. The current implementation lacks encryption and replay protection. SDLS is the IPsec for space, but adoption is low due to compute and latency overhead. Older satellites cannot be patched. Startup culture of fail fast collides with the reality that launched hardware is irretrievable.

Low Barrier to Entry: SDR Kits and Threat Models

▶ Watch (27:37)

A software-defined radio kit costs $47. Tools like GNU Radio and SatDump let anyone sniff space traffic. SatNOGS is an open-source community building ground station hardware. SPARTA is a threat model specific to space systems, covering orbital maneuvering and RF recon. Aerospace Corporation developed it. NIST released cybersecurity standards for commercial satellite operations in 2023. The EU launched a space ISAC in June 2025. The US Space Warfighting Center opened in Colorado for wargaming and experimentation.

Notable Quotes

They’re still using C C++ even for SpaceX. Anshu Gupta · ▶ 3:37

SDLS is the IP sex for space. Anshu Gupta · ▶ 27:17

There’s no encryption. There’s no replay protection. Anshu Gupta · ▶ 24:13

Key Takeaways

  • A $47 SDR kit and open-source software lower the barrier to space security research.
  • The KA-SAT wiper attack proved ground modem compromise can disrupt global space operations.
  • SPARTA provides a dedicated threat model for space-specific threats like orbital maneuvering.

About the Speaker

Anshu Gupta is a hands-on security professional with Fortune 500 consulting experience at Ernst & Young and KPMG. He worked with Microsoft, Salesforce, Oracle, Cisco, McAfee, Adobe, Yahoo, GAP, and Kaiser. He founded Fixin Security.