#609: How Hackers Target Satellites Through Ground Control Systems

Big thanks to DeleteMe for sponsoring this video. Protect your business with DeleteMe by using the following Link: https://joindeleteme.com/bombal-biz You’ll also get a free year of social media protection for every seat you purchase.

How do you hack a satellite? The attack can start on the ground. Watch a mission control demo showing how web vulnerabilities can change a simulated spacecraft’s orbit.

At DEF CON, I meet Milenko and Andrzej, the authors of The Spacecraft Hackers Handbook, to explore spacecraft cybersecurity. They explain the infrastructure behind satellite operations, what the Via sat attack actually targeted, and why protecting spacecraft requires both security and space engineering knowledge. Then Andrzej demonstrates previously patched vulnerabilities in an older version of mission control software. Using Burp Suite, he shows how path traversal exposes configuration files and how cross-site scripting can trigger a spacecraft command through an operator’s browser.

We cover:

• Why satellite security extends to systems on the ground

• How path traversal and XSS affect mission control software

• Telemetry, telecommands, CCSDS and the SDLS security layer

• How GPS supports timing as well as navigation

• Python examples, a prepared lab VM and learning resources

• The authors’ nine satellite cybersecurity challenges on Hack The Box

• Skills and career opportunities in spacecraft cybersecurity

The demonstration uses a spacecraft simulator. The vulnerabilities shown were disclosed to the vendor and patched.

// Link to No Starch Website for Milenko and Andrzej’s Book//

The Spacecraft Hacker’s Handbook: https://nostarch.com/spacecraft-hacke...

Use Coupon Code SPACE25 for 25% off The Spacecraft Hacker’s Handbook.

// Milenko Starcik’s SOCIALS //

Website: https://visionspace.com/team/milenko-...

Website 2: https://starcik.space/

// Andrzej Olchawa’s SOCIALS //

Website: https://visionspace.com/author/a-olch...

Website 2: https://andy.codes/

X: https://x.com/0x4ndy

// Online Resources //

https://spacesecurity.club

https://github.com/orgs/spacecrafthac...

// Blog Post REFERENCE //

https://www.hackthebox.com/blog/hack-...

// David's SOCIAL //

Discord: discord.com/invite/usKSyzb

Twitter: www.twitter.com/davidbombal

Instagram: www.instagram.com/davidbombal

LinkedIn: www.linkedin.com/in/davidbombal

Facebook: www.facebook.com/davidbombal.co

TikTok: tiktok.com/@davidbombal

YouTube: / @davidbombal

Spotify: open.spotify.com/show/3f6k6gE...

SoundCloud: / davidbombal

Apple Podcast: podcasts.apple.com/us/podcast...

// MY STUFF //

https://www.amazon.com/shop/davidbombal

// SPONSORS //

Interested in sponsoring my videos? Reach out to my team here: [email protected]

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

Disclaimer: This video is for educational purposes only.

#sattelitehacking #spacecraftcybersecurity #defcon