Rising concerns over hackers using satellites to target US
By Olivia Beavers (thehill.com) / June 26 2018
The rapidly expanding number of satellites transmitting GPS locations, cellphone signals and other sensitive information is creating new opportunities for hackers.
It’s a risk exacerbated by the growing number of aging satellite systems in circulation. While it is cheaper to leave old satellites in orbit rather than pulling them from space, the outdated systems are even easier targets for hacking.
Just last week, security researchers at Symantec warned that a China-based cyber espionage group known as Thrip targeted satellite, telecom and defense companies in the United States and Southeast Asia.
“Thrip’s attack on telecoms and satellite operators exposes the possibility that the attackers could intercept or even alter communications traffic from enterprises and consumers,” Symantec said in a statement, noting its malicious behavior was well-hidden behind legitimate information technology administration tools.
Thrip used malware to infect computers linked to the satellites in an attempt to seize control of them — efforts that suggest the group’s motivations could extend beyond spying and include “disruption,” according to Symantec.
The satellite concerns has further inflamed fears about China’s efforts to spy on the U.S. and to steal U.S. intellectual property.
The head of the House Homeland Security Committee connected the report on Thrip to Beijing’s efforts to steal intellectual property.
“Our satellites are more advanced so they are stealing our intellectual property — it is espionage to make their satellites on par with ours,” Rep. Michael McCaul (R-Texas) told The Hill in an interview.
“Both commercial and military — it is a huge threat.”
Other lawmakers said it is a wake-up call that highlights how critical infrastructure must be protected from outside threats.
“[I]t’s no surprise that bad actors, like China, continuously attempt to exploit vulnerabilities across our critical infrastructure,” Rep. John Ratcliffe (R-Texas), chairman of the Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, told The Hill in a statement.
“The Symantec report helps clarify the scope of these threats,” Ratcliffe continued, noting that the federal government and private sector must be “capable of securing our most sensitive technologies, including our satellite and telecommunications operations.”
While hackers have long targeted telecommunications for espionage, experts say cyber officials may not have initially had their eye towards the sky for such threats.
“This is a new twist on an old problem,” said Michael Daniel, former special assistant to the president and c ybersecurity coordinator for the Obama administration.
Daniel told The Hill that the U.S. didn’t initially think of cyberspace as a threat vector at the time satellites began popping into space, but now the federal government must learn how to “adapt” to this expanding environment.
“Unlike a lot of other environments, there is not more land on a daily basis, but on a daily basis there is more cyberspace. So we are making the problem harder because there is literally more territory to defend, if you will, on a daily basis,” he noted.
And when threat actors gain access to satellites, they can continue to gather information on their victims by tracking the traffic that comes through the satellites over time — which they could exploit later on.
“If they can siphon of real activity data … they are going to aggregate a lot of information how our operations are running, what we are requesting, what we are looking at, what are concerns are, so out of that you can get a really good picture,” said Jan Kallberg, a research scientist at the West Point’s Army Cyber Institute.
“If you listen to logistic requests for a long time, you would be able to know what the weaknesses are or what is problematic for us,” Kallberg added.
There is also concern that China and other foreign nations could wiggle into satellite systems now and remain embedded so that they are prepared to commandeer the systems in a time of war.
Daniel said the ability to cause disruption with satellites would be a desirable capability. If a country could leverage such infrastructure, he said, they would reserve it for a time of war or intense conflict because then the victim will have a better chance of determining who is behind the attack and then responding.
While cyber experts and officials say they have not observed satellites being used for digital warfare, it is not out of the realm of possibility particularly because Russia and other nation states have shown they are willing to use cyber weapons in times of conflict.
“We’ve seen Russia do this with Estonia and Ukraine, they are just throwing everything they get at Ukraine,” McCaul said.
“We haven’t seen as much of the cyber warfare [with China], not to say they don’t have that capability. We just haven’t seen them use it as much as say the Russians have,” the chairman added.
Russia-linked hacking groups have also previously been tied to satellite hacking campaigns.
Kaspersky Lab, a Moscow-based cybersecurity firm, warned in a 2015 blog post that a sophisticated “Russian-speaking” hacking group known as Turla APT had intercepted the flow of downstream traffic coming from a satellite to an unencrypted PC.
The firm, which described the group as “one the most advanced threat actors in the world,” said it has exhibited an “exquisite satellite-based command-and-control mechanism” that it can use as a base for launching cyberattacks.
The concerns about satellite-focused hackers comes just months after the Federal Communications Commission granted Tesla Founder Elon Musk’s space program, SpaceX, the right to “construct, deploy, and operate” a satellite system comprising of roughly 4,400 satellites.
These satellites will be joining the satellites already up in space, which may already be decades old.
“If they are still functioning and they make money … you leave it up there,” Kallberg said. “That is a huge vulnerability because they would be based off of technology that was maybe 10 to 15 years old.”
