(gentle music)
[Pavur] In the space world there's often essentially
security through obscurity
and in the cybersecurity world, in a hacker world,
we kind of know that security through obscurity never works.
Someone will eventually be able to understand what you do.
If it works it's probably intuitive at some level
and is thus intuitively exploitable.
People often think of satellites
as just another type of computer, but in space.
And so they think there aren't novel security problems.
The problem with satellites is
that they're just not built for any level of security.
There's no kind of dark magic in exploiting a satellite.
It's just a matter of downloading a few open source
or freely available tools
and plugging all of the equipment together
and figuring out how to point it to the satellite.
I used about $300 in home television equipment
to intercept sensitive satellite communications.
For a criminal attacker who just wants to harm someone
and make money, listening to satellite communications
is actually a fairly straightforward way to go about it.
(gentle music)
I'm James Pavur.
I'm a PhD student at Oxford University
where I research satellite cyber security.
And I kind of look at it from a bunch of different angles,
but fundamentally I'm a hacker.
So I'm interested in attacks and defenses.
So we wanted to understand what was happening
in these radio signals that were coming
from 30,000 kilometers above our heads
and whether or not they were being sent in a way
that revealed people's data
because these signals cover entire continents
so you never know who's listening.
We used a flat panel dish
just cause it fit on the specific roof
we were doing the research with,
but it doesn't matter what dish you use.
Literally any television satellite dish at your house
would be sufficient.
Once all of this is hooked up,
the next task is to hunt down a satellite
and you see a bunch of noise down here at very low levels.
And then you have these distinct humps
that are kinda standing out.
And those are frequencies on this specific satellite
that you might wanna listen to.
And then that card that we're using
can convert the radio waves into bits and bytes
and then you can analyze it, just like any internet traffic.
We've found that very basic commercial
home television equipment was sufficient
to intercept sensitive satellite communications,
affecting everything from individuals visiting the internet
in a coffee shop to fortune 500 companies
sending passwords for their internal infrastructure.
It raised serious concerns because we know
that we're not the only people out there who can do this.
And we're fairly certain
we're not the only people out there who have done this.
I think Hack-A-Sat is a really good step
towards getting more people who can apply skills
that are probably better than mine to these problems.
(intense music)
[Savage] Letting hackers into your system
for the sole purpose of having them try to hack it
and then reporting the results is a very, very good thing.
That's how you get some of these really deep exploits
that you probably would have missed otherwise
until some nefarious person comes in
and tries to exploit it for their own gain.
[Wade] When we're discussing the security of a system,
we think about attack vectors.
How could an attacker reach our system
if they were trying to get in.
With the satellite, it's a lot easier to think
that there really aren't attack vectors.
It's miles and miles up in the sky.
How's anyone gonna reach it?
And because of that logic,
a lot of the focus goes into making them low cost,
low power and very reliable.
Unfortunately, security tends to disrupt all of these.
There will be people who are hacking satellites.
And so by having the federal government structure this
in a nice, organized and safe way,
we can do it without getting in any trouble
and they can get the results and the understanding
that they need from an attacker's perspective.
[Savage] Having the ability to approach something with the mindset
of, "How could I break this?"
Always helps you understand how a system works better.
[Wade] It's something we all as a community
have to be thinking about.
(gentle music)
[Pavur] As I've gotten involved in space,
it started to dawn on me that it's not just
people landing on the moon and bouncing around really high,
which is definitely one of the coolest things about space,
but there's a lot of really important things
that affects the lives of ordinary people.
So space is a domain for everyone,
even if it often feels like these billion dollar projects
are completely devoid of relationship to everyday life.
(gentle music)
We haven't really applied many of these lessons
that we've gotten really good at dealing with on the ground
to the outer space context.
The people who want to cause harm to satellites
know that they're hackable,
but the people who maybe have the skills
to help protect satellites,
aren't necessarily even aware
that that's a place they can apply it.
Maybe nobody gets inspired to do exactly what I'm doing,
but even if there's some kid who's sitting at home
being like, "It would be really cool
to find new security vulnerabilities."
If my research can help drive that excitement,
then it's probably the best reward from it.
(gentle music)