Germany unveils plan to tackle cyberattacks on satellites
(2022/07/05)
- Reference: 1657023310
- News link: https://www.theregister.co.uk/2022/07/05/bsi_satellite_baseline/
- Source link:
The German Federal Office for Information Security (BSI) has put out an IT baseline protection profile for space infrastructure amid concerns that attackers could turn their gaze skywards.
The [1]document , published last week, is the result of a year of work by Airbus Defence and Space, the German Space Agency at the German Aerospace Center (DLR), and BSI, among others. It is focused on defining minimum requirements for cyber security for satellites and, a cynic might say, is a little late to the party considering how rapidly companies such as SpaceX are slinging spacecraft into orbit.
The guide categorizes the protection requirements of various satellite missions from "Normal" to "Very High" with the goal of covering as many missions as possible. It is also intended to cover information security from manufacture through to operation of satellites.
[2]
The "Normal" category correlates to damage that is limited and manageable. "High" is high-consequence damage that "can significantly limit the operation of the satellite system." As for "Very High," the attack could result in shutdown and "reach an existentially threatening, catastrophic extent for the operator or the manufacturer."
[3]
[4]
The detail is impressive, although the document is more a baseline of what requires attention (via a checklist) rather than a straightforward set of instructions. Phases of the satellite lifecycle includes design, testing, transport, commissioning operation, and finally decommissioning. Then there are the networks and applications used to support the spacecraft itself, right down the level of subnet or server room.
As satellites get smarter, their attack surface area increases. In addition, disrupting constellations and communications is arguably yet another front for conflicts. The European Space Agency (ESA) invited hackers to have a crack at its OPS-SAT spacecraft (in a controlled environment) [5]earlier this year with a view to understanding and dealing with vulnerabilities.
[6]How do you sing 'We're jamming and we hope you like jamming, too' in Russian? Kremlin's sat-nav spoofing revealed
[7]Starlink's success in Ukraine amplifies interest in anti-satellite weapons
[8]Russia: The hole in the ISS Soyuz lifeboat – was it the crew wot dunnit?
[9]SpaceX: 5G expansion could kill US Starlink broadband
Cybersecurity in space is increasingly important. Just over a decade ago, a pair of US-maintained environmental monitoring satellites experienced " [10]interference " and while anti-satellite weaponry [11]can do untold damage , cyber warfare has continued to spread. After all, why aim a missile at a satellite if an atacker can bend it to their will?
Drilling through the drives after EOL?
As for the BSI document, it goes as far as considering what do with satellites past the end of their lifetime. The spacecraft might contain all manner of crypto secrets and will require monitoring if sent to a graveyard orbit.
"Even if all requirements are implemented," the document warns, "100 percent security cannot be achieved.
[12]
"Targeted attacks on the information technology of facilities of all kinds are increasing. Security gaps in the systems that have become known are being exploited more and more quickly. It is not always possible to rectify the problem in good time by means of appropriate updates."
Wise words, and equally applicable on the ground as in orbit. ®
Get our [13]Tech Resources
[1] https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/Hilfsmittel/Profile/Profil_Weltrauminfrastrukturen.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/01/11/ops_sat_hack/
[6] https://www.theregister.com/2019/04/02/gps_spoofing_russia/
[7] https://www.theregister.com/2022/06/02/anti_satellite_weapons/
[8] https://www.theregister.com/2018/09/14/hole_in_soyuz_caused_by_crew_says_russian_media/
[9] https://www.theregister.com/2022/06/23/starlink_dish_satellite_internet/
[10] https://www.theregister.com/2011/11/21/us_sat_hack_mystery/
[11] https://www.theregister.com/2021/11/16/russia_satellite_iss/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
The [1]document , published last week, is the result of a year of work by Airbus Defence and Space, the German Space Agency at the German Aerospace Center (DLR), and BSI, among others. It is focused on defining minimum requirements for cyber security for satellites and, a cynic might say, is a little late to the party considering how rapidly companies such as SpaceX are slinging spacecraft into orbit.
The guide categorizes the protection requirements of various satellite missions from "Normal" to "Very High" with the goal of covering as many missions as possible. It is also intended to cover information security from manufacture through to operation of satellites.
[2]
The "Normal" category correlates to damage that is limited and manageable. "High" is high-consequence damage that "can significantly limit the operation of the satellite system." As for "Very High," the attack could result in shutdown and "reach an existentially threatening, catastrophic extent for the operator or the manufacturer."
[3]
[4]
The detail is impressive, although the document is more a baseline of what requires attention (via a checklist) rather than a straightforward set of instructions. Phases of the satellite lifecycle includes design, testing, transport, commissioning operation, and finally decommissioning. Then there are the networks and applications used to support the spacecraft itself, right down the level of subnet or server room.
As satellites get smarter, their attack surface area increases. In addition, disrupting constellations and communications is arguably yet another front for conflicts. The European Space Agency (ESA) invited hackers to have a crack at its OPS-SAT spacecraft (in a controlled environment) [5]earlier this year with a view to understanding and dealing with vulnerabilities.
[6]How do you sing 'We're jamming and we hope you like jamming, too' in Russian? Kremlin's sat-nav spoofing revealed
[7]Starlink's success in Ukraine amplifies interest in anti-satellite weapons
[8]Russia: The hole in the ISS Soyuz lifeboat – was it the crew wot dunnit?
[9]SpaceX: 5G expansion could kill US Starlink broadband
Cybersecurity in space is increasingly important. Just over a decade ago, a pair of US-maintained environmental monitoring satellites experienced " [10]interference " and while anti-satellite weaponry [11]can do untold damage , cyber warfare has continued to spread. After all, why aim a missile at a satellite if an atacker can bend it to their will?
Drilling through the drives after EOL?
As for the BSI document, it goes as far as considering what do with satellites past the end of their lifetime. The spacecraft might contain all manner of crypto secrets and will require monitoring if sent to a graveyard orbit.
"Even if all requirements are implemented," the document warns, "100 percent security cannot be achieved.
[12]
"Targeted attacks on the information technology of facilities of all kinds are increasing. Security gaps in the systems that have become known are being exploited more and more quickly. It is not always possible to rectify the problem in good time by means of appropriate updates."
Wise words, and equally applicable on the ground as in orbit. ®
Get our [13]Tech Resources
[1] https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/Hilfsmittel/Profile/Profil_Weltrauminfrastrukturen.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/01/11/ops_sat_hack/
[6] https://www.theregister.com/2019/04/02/gps_spoofing_russia/
[7] https://www.theregister.com/2022/06/02/anti_satellite_weapons/
[8] https://www.theregister.com/2018/09/14/hole_in_soyuz_caused_by_crew_says_russian_media/
[9] https://www.theregister.com/2022/06/23/starlink_dish_satellite_internet/
[10] https://www.theregister.com/2011/11/21/us_sat_hack_mystery/
[11] https://www.theregister.com/2021/11/16/russia_satellite_iss/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YsRgHxsc0KXf92COGVQitQAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
sitta_europea
Or even just dropping a space station on a city.
elsergiovolador
The level above "Epic High" should be "Gargantuan High" which is a catastrophic event for space, where basically the space is closed and black holes are angrily sucking each other. Given that the time would no longer exist, we wouldn't even know.
Paul Crawford
You mean a universal out of cheese error?
Paul Crawford
The spacecraft might contain all manner of crypto secrets and will require monitoring if sent to a graveyard orbit
If your satellite has any secrets that are not specific to itself and itself alone (e.g. signature for command authentication) then you are doing things very badly.
File this under 'Aye, right'
Danny 2
This is one of these 'I don't care if you believe me, why would I lie' anecdotes, which I have posted here years ago.
My Dutch ex-fiancee told me that one of her pals had hacked a British satellite and changed it's orbit. I mansplained .to her that what she meant to say was her pal had hacked satellite communications bandwidth, and what she claimed was impossible.
Couple of weeks later I read on a high security intranet that a British military satellite had been lowered in orbit until a £10 million ransom was paid. Never made the press for obvious reasons.
" reach an existentially threatening, catastrophic extent for the operator or the manufacturer. "
And the level above that should be "Epic High" which is a catastrophic event for humanity, a Kessler Syndrome that could (depending on what actually happens) put a hold on space exploration, and potentially even using certain types of satellites, for decades if not longer.