CybersecurityU.S. military communication satellites vulnerable to cyberattacks

Warnings of satellite communications vulnerabilities to cyberattacks // Source: commons.wikimedia.org

A new report, A Wake-up Call for SATCOM Security, by IOActive, a Seattle-based cybersecurity firm, warns that satellite communication terminals used by U.S. military aircrafts, ships, and land vehicles to share location data, are vulnerable to cyberattacks through digital backdoors. A forensic security review of codes embedded inside the circuit boards and chips of the most widely used SATCOM terminals identified multiple hacker entry points. According to the Christian Science Monitor, the terminals cited in the report are built by six of the world’s leading SATCOM equipment manufacturers, who also serve nonmilitary clients such as energy companies, which use the terminals to collect data from remote oil and gas pumping sites. The terminals reviewed connect with Inmarsat, a British satellite communications provider, and Iridium, a U.S.-based provider. Soaring demand for satellite bandwidth means government and military communications are increasing using commercial satellite data pathways that may be less protected.

Industry officials, aware of the IOActive report, say SATCOM terminals are secure when security features are activated and used properly, noting that the terminals are not insecure by design. Researchers found, however, that malicious actors could intercept, manipulate, or block communications and potentially remotely take control of the SATCOM terminals reviewed in the report.

Ruben Santamarta, author of the report, said vulnerabilities in the firmware, the software which is installed on the memory chip that primarily controls the terminals, includes digital backdoors embedded into the computer code, insecure communications protocols, and weak encryption. In some cases, a hacker might only need to send a text message that includes malicious code to take control of a SATCOM terminal, thereby allowing for a nation-state adversary to potentially fake the locations of aircrafts, ships, and ground forces.

“If one of these affected devices can be compromised, the entire SATCOM infrastructure could be at risk,” the report says. “Ships, aircraft, military personnel, emergency services, media services, and industrial facilities (oil rigs, gas pipelines, water treatment plants, wind turbines, substations, etc.) could all be impacted by the vulnerabilities.”

The Department of Defense (DoD) in response to questions of vulnerabilities in its satellite communication devices, said that anything connected to the Internet is potentially vulnerable, but DoD manages “all cyber-risks in accordance with one of DoD’s primary cyber-space missions: Defense of all DoD information networks.”

Some experts say that though vulnerabilities exist within satellite communications systems, they are difficult to exploit in practice. “No doubt it’s a concern, but it’s unlikely U.S. aircraft will begin dropping out of the sky anytime soon,” says John Bumgarner, research director for the U.S. Cyber Consequences Unit, a cyber-security think tank. “It’s just not very easy to launch some of these attacks, even if you know the vulnerabilities involved. Yes, they can happen. But it requires tons of reconnaissance and planning to pull it off.”

The Global VSAT Forum (GVF), representing the satellite communications industry, recently announced a “cyber-security task force” to address the threat to terminals and communications systems. “We’re working with industry to thwart indicators of cyber-attacks being made on the entire telecommunications sector,” says David Hartshorn, GVF secretary general. “Our new task force was scrambled to advance and enable best practices throughout the global satellite industry to address these threats.”

Commercial satellite providers like Intelsat General Corporatio (IGC), a subsidiary of Intelsat, have about fifty satellites in its fleet and is experiencing a surge in demand, partly due to increasing use of drones and manned ISR missions (intelligence, surveillance, reconnaissance). Intelsat has had its share of cyber-attacks. “In the cyber-security area, we have seen significant activity and we have had to take strong action to deal with that,” said Mark Daniels vice president of engineering and operations for IGC. Intelsat, the parent company, “deals with cyber-attacks on a daily basis.”

IOActive has provided classified details of vulnerabilities found in its study to satellite operators Iridium and Inmarsat, and to SATCOM companies including Cobham, Hughes, Harris Corporation, Japan Radio Corporation, and Thuraya, a mobile satellite operator. Dubai-based Thuraya issued a statement on the IOActive report saying, “as Thuraya’s equipment was not tested in a real world environment, the results and the conclusions of the whitepaper are theoretical and not a proper assessment of the equipment’s security features.”