AI
Ground and Space Segments Expose New Attack Surface
Commercial providers like SpaceX and OneWeb are launching thousands of satellites. The attack surface is exploding. Most prior research focused on user equipment like Starlink dishes. The ground segment and space segment were neglected. Mission control software like OpenC3, NASA’s openMCT, and Yamc run on decades-old code. Onboard software like NASA’s Core Flight System (cFS) is reused across dozens of missions, including payloads on the James Webb Space Telescope.
OpenC3 XSS Grants Full Mission Control Access
OpenC3 is vulnerable to XSS. An attacker generates a malicious URL and fishes a spacecraft controller. Once clicked, the payload steals session tokens and deploys a script on the mission control system. The attacker gains full access to the system that commands the spacecraft. The operator sees no change. The demo showed the attacker taking over the OpenC3 interface.
Memory Management Flaw Gives Reverse Shell on Spacecraft
NASA’s Core Flight System memory management module imposes no restrictions on which memory addresses can be read or written. An attacker with ground segment access and spacecraft visibility can send telecommands that overwrite the Global Offset Table. The function mechr is replaced with system. The next telecommand executes an arbitrary payload. The demo returned a reverse shell from the spacecraft simulator.
Over 20 Vulnerabilities Found, Industry Lacks Security Awareness
The team disclosed over 20 vulnerabilities since 2023, including code execution and arbitrary file deletion in YAMC. Maintainers fixed issues within weeks. No one had told them to write secure software. A French researcher later bypassed an encryption plugin for cFS. More vulnerabilities were found using Valgrind. The space industry lacks security awareness. “Space security doesn’t need to be hard,” Starcik said.
Notable Quotes
the attack surface is exploding Milenko Starcik · ▶ 0:54
no one was actually telling them to to write secure software it seems Milenko Starcik · ▶ 14:54
you might have a much easier time if you exploit the vulnerabilities in the ground segment or in the spacecraft system. Milenko Starcik · ▶ 6:25
space security doesn’t need to be hard. Milenko Starcik · ▶ 17:11
Key Takeaways
- XSS in OpenC3 mission control can lead to full spacecraft command takeover.
- Core Flight System’s memory management lacks address restrictions, enabling code execution.
- Over 20 disclosed vulnerabilities since 2023 show space software lacks proactive security.
About the Speaker(s)
Ayman Boulaich is a cybersecurity researcher specializing in vulnerabilities within aerospace systems. He has contributed to identifying critical security issues in NASA’s open-source software frameworks, such as Core Flight System (cFS) and CryptoLib.
Ricardo Fradique is a Cybersecurity Engineer at VisionSpace Technologies GmbH, with a focus on Offensive Security and Vulnerability Research. He has been credited in several CVEs, and a regular CTF player.