Share on

Zero Gravity Exploits: Reverse Engineering and Fuzzing Low-Earth Orbit Satellites

REGISTER

Talk overview:

Satellites play an essential role in our modern lives, providing critical services such as telecommunications, global navigation, and earth observation. Recent developments taking place in the “New Space” era have skyrocketed the number of satellites in orbit, especially in Low-Earth Orbit (LEO). Although these satellites often provide critical services, little research has reviewed their security. We are the first to conduct an in-depth security analysis on these LEO satellites by reverse engineering, analyzing, and fuzzing onboard firmware of multiple satellites.
Beginning with an exploration of satellite architecture and satellite-specific software aspects, we use an active European Space Agency (ESA) satellite as a running example. We dive into reverse engineering the satellite software, focusing on the satellite’s command-and-control logic; this logic is key to exploitation as it processes telecommands sent from the ground station, which are used to operate and control the satellite remotely. We then present our manual code analysis scheme and the vulnerabilities we found; when chained together, allowing us to take over the satellite. Following this full compromise of our running example, we will discuss how to utilize firmware fuzzing to uncover interesting vulnerabilities in several satellites. We highlight satellite-specific aspects for firmware fuzzing optimizations and how we fuzzed a complete satellite firmware image. We then put the vulnerabilities to the test by live-exploiting a satellite’s digital twin. The vulnerabilities allow us, an unauthenticated and external attacker, to hot-patch the satellite and to lock out the original operators.

Johannes Willbold is a doctoral student at the chair for systems security at the Ruhr University Bochum in Germany. In this doctoral thesis, he focuses on the security of space and satellite systems, with a particular emphasis on understanding real-world security issues by studying otherwise hard-to-access space software. His first paper on the security of onboard satellite software “Space Odyssey: An Experimental Software Security Analysis of Satellites” was recently accepted to the IEEE S&P 2023 conference. In 2022, Johannes visited the Cyber-Defence Campus in Switzerland for an extended research stay on satellite security, where he investigated the security of VSAT systems. He is co-founder and co-chair of SpaceSec, the first academic workshop on space and satellite systems security, which is co-located with the top-tier security conference NDSS. He also participated in the Hack-A-Sat 2 finals, spoke at the CySat 2022 and 2023 on the software security of satellites, and was recently invited to ESA for a talk on onboard satellite firmware security. Tobias Scharnowski is a systems security researcher at CISPA. In his academic research, he focuses on the automated security testing of embedded firmware. Previously, he also participated in the DEF CON CTF Finals and was the first to demonstrate a hack of DNP3 at Pwn2Own Miami in 2020, the protocol that powers the American electric grid. Recently, he has focused on how fuzzing can be leveraged to automatically uncover vulnerabilities in satellites.
REGISTER
Johannes Willbold & Tobias Scharnowski
Space and satellite systems security researchers
Johannes Willbold is a doctoral student at the chair for systems security at the Ruhr University Bochum in Germany. In this doctoral thesis, he focuses on the security of space and satellite systems, with a particular emphasis on understanding real-world security issues by studying otherwise hard-to-access space software. His first paper on the security of onboard satellite software "Space Odyssey: An Experimental Software Security Analysis of Satellites" was recently accepted to the IEEE S&P 2023 conference. In 2022, Johannes visited the Cyber-Defence Campus in Switzerland for an extended research stay on satellite security, where he investigated the security of VSAT systems. He is co-founder and co-chair of SpaceSec, the first academic workshop on space and satellite systems security, which is co-located with the top-tier security conference NDSS. He also participated in the Hack-A-Sat 2 finals, spoke at the CySat 2022 and 2023 on the software security of satellites, and was recently invited to ESA for a talk on onboard satellite firmware security. Tobias Scharnowski is a systems security researcher at CISPA. In his academic research, he focuses on the automated security testing of embedded firmware. Previously, he also participated in the DEF CON CTF Finals and was the first to demonstrate a hack of DNP3 at Pwn2Own Miami in 2020, the protocol that powers the American electric grid. Recently, he has focused on how fuzzing can be leveraged to automatically uncover vulnerabilities in satellites.