Space weaponsHacked satellite could launch microwave-like attacks

The satellite communications which ships, planes, and the military use to connect to the internet are vulnerable to hackers which, in the worst-case scenario, could carry out “cyber-physical attacks,” turning satellite antennas into weapons which operate, in effect, like microwave ovens.

Ruben Santamarta, a researcher for the information security firm IOActive, in a talk at the Black Hat conference in Las Vegas, said that a number of popular satellite communication systems are vulnerable to such attacks, which could also leak information and hack connected devices.

The attacks, which are currently merely a nuisance for the aviation sector, may well pose a safety risk for military and maritime users, the research claims.

“The consequences of these vulnerabilities are shocking,” Santamarta said. “Essentially, the theoretical cases I developed four years ago are no longer theoretical.”

Extreme Tech reports that the attack works by connecting to the satellite antenna from the ground, through the internet, and then using security weaknesses in the software which operates the antenna to seize control.

The potential damage varies from there. The attack may disrupt, intercept, or modify all communications passed through the antenna, allowing an attacker to eavesdrop on emails sent through an in-flight Wi-Fi system. The attacker may also launch further hacking attacks against devices connected to the satellite network.

In some situations, the safety risk is higher still. In the case of the military, the attack also exposes the location of the satellite antenna, since they usually need an attached GPS device to function. “If you can pinpoint the location of a military base, that’s a safety risk,” Santamarta noted, “but not for a plane or a ship”, whose locations are generally public.

Both military and maritime users are also at the risk of what Santamarta described as “cyber-physical attacks”: repositioning the antenna and setting its output as high as it will go, to launch a “high intensity radio frequency (HIRF) attack.”

“We’re basically turning Satcom devices into radio frequency weapons,” Santamarta said. “It’s pretty much the same principle behind the microwave oven.” Even if the antenna can’t be used to physically injure soldiers, passengers or crew, a HIRF attack can also cause physical damage to electrical systems.

The safety risk is not as high for the aviation sector, Santamarta said, because planes tend to be built with a significant amount of HIRF shielding in place. “The industry has done a good job of putting strong design and testing standards in place that would protect critical flight systems from HIRF attacks using airborne Satcom equipment,” Santamarta writes in his report, adding that it “should be commended for identifying an emerging threat”.

IOActive says that following its research, it worked with the aviation industry to ensure that affected airlines are no longer exposing their fleets, and passengers, to the open internet. The company reported the issues with the maritime and military uses of satellite technology to U.S. and EU regulators, but it has not received any further information about fixes.