In the past, space tech was unique and classified, so it was hard for an outsider to discover vulnerabilities in space control systems. That’s why hacker attacks on such targets were largely unsuccessful.
The situation changed in the 2020s. In modern spacecraft, unique analog devices of the past were replaced by digital solutions from known vendors. Of course, new security standards and such concepts as "cyberimmunity" are already known to space tech development. But the practical application of these safety principles is still lagging behind the desired level.
This problem concerns large commercial satellite constellations, such as OneWeb and Starlink. To reduce the production cost, satellite developers use cheap and widely available components without serious cybersecurity audits. Meanwhile, malefactors can easily find those components on the Earth, test it and discover the vulnerabilities needed for the attack. If this attack is successful, law enforcement cannot simply confiscate the compromised server from the hosting provider – because the server is far away in space!
As a result, hacker groups gain control over hundreds of satellites and exploit them. Some compromised satellites are used to host anonymizer proxies and botnet command and control centers. Other hackers demand a big ransom for satellite control, threatening to crash seized satellites into manned space stations in case of refusal.
In most critical situations, compromised satellites are shot down by the military. However, satellite owners are not happy with such strong measures, because launching new satellites is costly. Additionally, debris of shot satellites can fly along unpredicted trajectories and may harm other space objects.
An alternative solution is proposed by a well-known cybersecurity vendor. In partnership with space tech companies, Kaspersky launched the space drone KRSat (Kaspersky Rescue Satellite). This robot helps to fix the most complicated cases by catching and curing hacked satellites when remote control override from the Earth doesn’t work.
To complete its mission, KRSat connects to a satellite right on the orbit via alternative channels including physical ports. The robot then performs diagnostics, removes malware and restores normal functioning of the apparatus. Or, if the hacked satellite is completely incurable, KRSat takes measures for its safe disposal.
