Inside the mysterious US satellite hacking case

Original URL: https://www.theregister.com/2011/11/21/us_sat_hack_mystery/

Ground station denies hack, US cyber general baffled

Posted in Security, 21st November 2011 12:09 GMT

Analysis The cause and perpetrators behind interference against two US scientific satellites remains unknown to American military commanders more than three years after the mysterious event.

The Congressional US-China Economic Security and Review Commission said in its latest annual report that two US-maintained environment-monitoring satellites experienced interference at least four times in 2007 and 2008. Draft versions of the dossier, seen prior to the publication of the completed report last Wednesday, suggested the interference came from a ground station in Spitsbergen, Norway, and paints China as the chief suspects behind the presumed attacks.

However the satellite services firm running the ground station told El Reg that there's no evidence of any attack against its systems. Separately the commander of US military space operations said that insufficient evidence made it impossible to confidently attribute blame over the possible attempts to take control of the Landsat-7 and Terra AM-1* satellites, which are both managed by NASA.

"The best information that I have is that we cannot attribute those two occurrences," said General Robert Kehler, commander of the U.S. Strategic Command, Reuters reports. "I guess I would agree that we don’t have sufficient detail."

Kehler made his comments during a conference call on cyber and space issues.

Earlier drafts of the commission's report traced the cause of the probe interference to the Norwegian ground station owned and run by Kongsberg Satellite Services (KSAT), which denied any occurrence of interference via its facilities. In response to queries by El Reg, the satellite services issued a statement saying a thorough investigation has turned up nothing amiss. Neither NASA, which maintains the satellites, nor regulators at the National Oceanic and Atmospheric Administration had complained, it added

The statement read:

KSAT has not experienced any attempt to enter into the company’s systems from outside sources. Furthermore, KSAT does not have any indication that hacking of satellites using the KSAT Svalbard station has taken place. A careful screening of our security systems has not indicated any attempts to access SvalSat from unauthorized sources.
We have not received any message from NASA that their satellites were hacked. To our knowledge, NASA has not observed any external, unauthorized access to their satellites.

The internet is occasionally used for distribution of x-band payload data received from the satellites to the end user. Hence, this communication channel cannot be an access point for unauthorized access if it had happened. Due to the layout of our communication systems it is not possible to access any NASA satellites from KSAT sources.

The US government, represented by NOAA, regularly inspects KSAT operation. Irregular activity has not been observed nor reported.

References to KSAT and Svalbard were removed from the commission's final report because, according to a KSAT spokesman, the hacking allegations were "unsubstantiated and no evidence has been found".

Despite this, the congressional committee report continues to argue that interference against the US satellites remains a threat. It says Chinese military doctrine advocates the use of techniques for disabling an enemy's ground-based satellite control facilities during a time of conflict.

China is now among the top few space powers in the world. China’s leadership views all space activities through the prism of comprehensive national power, using civil space activities to promote its legitimacy in the eyes of its people, to produce spin-off benefits for other industries, and for military-related activities. For example, China appears to be making great strides toward fielding regional reconnaissance-strike capabilities. China has also continued to develop its antisatellite capabilities, following up on its January 2007 demonstration that used a ballistic missile to destroy an obsolete Chinese weather satellite, creating thousands of pieces of space debris.
As a result, in April 2011, astronauts evacuated the International Space Station out of concern of a possible collision with this debris.

In addition, authoritative Chinese military writings advocate attacks on space-to-ground communications links and ground-based satellite control facilities in the event of a conflict. Such facilities may be vulnerable: in recent years, two U.S. government satellites have experienced interference apparently consistent with the cyber exploitation of their control facility.

The report says links between supposedly secure control networks and the internet offer a soft underbelly that's open to attack.

Malicious actors can use cyber activities to compromise, disrupt, deny, degrade, deceive, or destroy space systems. Exploitations or attacks could target ground-based infrastructure, space-based systems, or the communications links between the two.
Authoritative Chinese military writings advocate for such activities, particularly as they relate to ground-based space infrastructure, such as satellite control facilities.

Satellites from several U.S. government space programs utilize commercially operated satellite ground stations outside the United States, some of which rely on the public Internet for "data access and file transfers," according to a 2008 National Aeronautics and Space Administration quarterly report.

The use of the Internet to perform certain communications functions presents potential opportunities for malicious actors to gain access to restricted networks.

Chinese whispers

The report suggests the Chinese might have been trying out these tactic on a real, albeit non-military, satellite network. There's no evidence that this is what happened however and even the committee admits the attack has not been traced back to China.

The National Aeronautics and Space Administration confirmed two suspicious events related to the Terra EOS satellite in 2008 and the U.S. Geological Survey confirmed two anomalous events related to the Landsat-7 satellite in 2007 and 2008.
If executed successfully, such interference has the potential to pose numerous threats, particularly if achieved against satellites with more sensitive functions. For example, access to a satellite’s controls could allow an attacker to damage or destroy the satellite. The attacker could also deny or degrade as well as forge or otherwise manipulate the satellite’s transmission. A high level of access could reveal the satellite’s capabilities or information, such as imagery, gained through its sensors. Opportunities may also exist to reconnoiter or compromise other terrestrial or space-based networks used by the satellite.

These events are described here not on the basis of specific attribution information but rather because the techniques appear consistent with authoritative Chinese military writings. For example, according to Military Astronautics, attacks on space systems ‘‘generate tremors in the structure of space power of the enemy, cause it to suffer from chain effects, and finally lose, or partly lose, its combat effectiveness.’’ One tactic is ‘‘implanting computer virus and logic bombs into the enemy’s space information network so as to paralyze the enemy’s space information system.’’

The apparently hawkish Congressional committee warns the Pentagon and NASA to stay alert against "potential Chinese counterspace activities". An opening address (PDF) by committee chairman William A. Reinsch on Wednesday makes mention of the politician's concern about China's intentions in space. Reinsch also criticises China's alleged cyberspying activities against Western government and hi-tech firm.

While all nations have the right to develop the means to defend themselves, the Commission continues to be concerned with the opacity of China’s military development and intentions, which invites misunderstanding. And, in particular, our report notes China’s development of its cyber capabilities, focusing on the growing evidence that Beijing sponsors or condones computer network intrusions against foreign commercial and government targets. When combined with the military’s excessive focus on other disruptive military capabilities, such as counterspace operations, it presents an image of Chinese intentions that diverges significantly from Beijing’s official policy of peaceful development.

The Chinese government has previously denied having anything to do with the hacking of two US satellites when the allegations first surfaced last month. Embassy officials repeated these denials on publication of the commission's final report this week.

Embassy officials told Reuters that it "obvious that the commission is entrusted with the mission of vilifying China’s image and spreading China threat theory by patching up unwarranted allegations against China."

"We urge the commission to stop issuing such reports for the good of increasing mutual trust between our two countries while China will continue to play a responsible role in both the realistic and the virtual worlds," Wang Baodong, an embassy spokesman, in an email to the news agency.

Concerns about the security of US space systems have been raised before.

The US-China Economic Security and Review Commission's report comes eight months after an official audit of NASA's network concluded that the space agency faces a high risk of cyberattack.

Experts from the Office of the Inspector General (OIG) warned that vulnerabilities in the space agency's network left it open to defacement, denial of service or information-stealing attacks. In particular, six unnamed IT systems – which included systems that control spacecraft – were wide open to attack as a result of unpatched software vulnerabilities.

"We found that computer servers on NASA's Agency-wide mission network had high-risk vulnerabilities that were exploitable from the internet," OIG said. "Specifically, six computer servers associated with IT assets that control spacecraft and contain critical data had vulnerabilities that would allow a remote attacker to take control of or render them unavailable." ®

Bootnote

* The Landsat Program is a series of Earth-observing satellite missions jointly managed by NASA and the US Geological Survey. Terra is a scientific satellite programme managed by NASA looking for evidence on climate change, among other functions.