CyberWire Daily - Space cybersecurity starts on the ground. [T-Minus

CyberWire Daily - Space cybersecurity starts on the ground. [T-Minus: Space-Cyber Briefing]

Though spacecraft are important, space cybersecurity extends well beyond these assets touching ground stations, mission-control assets, and other critical components.

h Milenk Starcevic, cybersecurity lead at Vision Space, and Andrzej “Andy” Olchawa, a space-focused offensive security professional, the broader space cybersecurity attack surface. By considering all aspects of a space mission, both in orbit and on the ground, cybersecurity professionals can better understand where vulnerabilities exist and what measures can be taken to reduce risk.

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠.

You're listening to the Cyberwire Network, powered by N2K.

Standard active directory migration tools don't move AES keys.

That means when you cut over, your applications fail silently.

In my recent conversation with Sempros' Mike Masqualey,

I asked him why standard migration tools miss these accounts

and how identity teams can fix them before cutover day.

Listen to our full conversation now at explore.thecyberwire.com slash Semperus.

I want to let you know a special gathering hosted by Zimperium at the Spy Museum in Washington, D.C.

This invitation-only event will bring together federal cybersecurity and technology leaders

to some of the most pressing challenges facing government today,

including mobile security, mission resilience, and the overall.

evolving threat landscape. I'm always grateful for opportunities to spend time with smart people

doing important work, and I'm excited to be part of these conversations. I hope to see some

familiar faces there. If you're interested in attending, you can request an invitation.

You'll find more information in our show notes. Our thanks to Zimperium for sponsoring this event.

We'll see you there. Understanding how a space mission works is something that is quite important,

and to understand that a breach in one system

might have a different impact on the actual mission

and there is some malicious files hosted on that server,

for example, that might have for the actual satellite

But if you manage to break into the mission control system

you can suddenly send commands to the actual spacecraft

without requiring a ground station on your own.

Welcome. I'm Maria Vermazes, and you're listening to T-minus a cyber briefing.

In this show, we examine the evolution of cybersecurity and the global and orbital infrastructure

that powers, protects, and connects our lives.

Hi, everyone. Thanks for joining me today.

Sometimes it happens in the world of podcasting, where you have an interview that is so jam-packed

with good stuff that you need to it with the world in two separate parts, part one this

And that is what happened when I chatted with two people who are foundational to the global space cybersecurity community.

And they would be Melancho Starchick and Andre or Andy Olkawa of Vision Space.

These two have been very busy the past few years going from Infosec Con to Con, presenting on or teaching space cybersecurity as they go.

And they have also written a book coming out soon from No Starge Press called The Spacecraft Hackers Handbook,

which they will tell you more when we get started.

Now, we cover a lot of ground on space cybersecurity in this and week's episodes,

and the goal here is to point Infosec professionals in the right direction

on the fundamentals of space cybersecurity.

So, without further ado, let's get started.

Gentlemen, thank you both so much for joining me,

especially after what sounds like an extraordinarily busy but worthwhile DefCon.

Welcome back. I hope you've recovered from Concrud. I hope you're feeling better.

Almost. Almost. Thank you. Thank you very much.

Well, why don't we start with an introduction? So since I'm speaking to two of you, our audience can get to know whose voice is whose.

Sure, yeah. I'm Milenko Star Trek. I'm currently leading the cybersecurity team at Vision Space in Germany.

My background is mostly in actually telecommunications, but then moved quickly to focus on cyber security.

I've been in the space industry now since roughly eight years.

I've been interested in that for much longer than that, almost my entire life, basically.

I've been in cyber security sector since around three to four years when I crossed from software engineering to offensive security and that's what I'm mainly focusing on right now.

So it's like offensive security activities for space systems and space customers.

My background is software engineering and software engineering and I spent around 50.

years prior to my transition to offensive security, working for in space industry,

maintaining and developing mission control systems and ground-sailing applications in general.

Gentlemen, thank you both so much for those great intros and for joining me today.

I don't normally say this part, but I know you have a book that is coming out,

and this book is so important to our audience.

Normally I would say leave it to the end, but I actually want to make sure we get to this first.

So yeah, we have the spacecraft hackers handbook coming out with Nostage Press.

It has been almost two very busy years writing.

I think the idea was born like December almost two years ago,

Now, recently we've been to DefCon and actually got first time physical copy

So yeah, it's been very exciting and it gives a very nice introduction to space security.

So we go from from zero for cybersecurity professionals who want to get into space cybersecurity,

but also for space professionals to get more into cyber security.

So starting from the actual how a space machine works, what the risks are that are specific for space.

And then very quickly into actually hands-on testing, ground segment applications, on-board software,

and also going to satellite terminals and GNSS systems.

As I mentioned earlier, I genuinely cannot wait to get my hands on this book.

And I imagine every single person listening to this podcast will want to do the same.

And I figured, Milanko, why don't we start with you?

I imagine when the two of you were thinking putting this book together,

there were, I'm sure, a number of maybe what we might call canon events in space cyber security

The one that I often think of is, you know, VySat 2022, but I'm sure that is not the only one.

This is a question I get a lot from people who are interested in space cyber, and I'm sure

you do too, what are those sort of canon events that people need to know and study

Can you give me maybe a bit of a lay of the land there?

there have in the past been quite a number of events i think it's currently it's accelerating and there

is many small events it's i think not just the big bang events like the via set incident

which was very popular and drove a lot of the developments that are currently happening but it's

it's often the smaller events i think that show where the actual weaknesses currently are so

there have been, for example, these hack and leak incidents with the European Space Agency

where like hundreds of gigabytes of sensitive, sometimes sensitive data have been exfiltrated

And I think this shows very well the big weakness is often not actually on the satellite,

but it's on the ground and it's sometimes not even specialized infrastructure.

which can be just something ordinary that you would find in any other tech company, for example,

This is a really interesting point that you bring up right here how many of the threats

in space cybersecurity are not necessarily hyper-specialized to space.

And I wonder the perception versus reality there where I know, at least to me,

it seems from the space industry, there's a lot of, it seems almost mythology,

the skill set needed to be a space cyber professional versus what to the two of you I think bring is a good reality check on what actually is needed for a you know infosec professionals to understand at least at a basic level how space cybersecurity works

I think the most important thing is to understand that the actual space attack surface is very narrow and is very small even if we are talking

constellations, all those spacecraft are always the same.

There might be thousands of spacecraft flying in the constellation,

and they present like one attack surface, like one node in the whole system.

And most of the system actually is present in the ground segment.

And that is a compilation of many, many different technologies.

many different infrastructure, hardware and software, which often is not something related

to space, but they make up the whole system, or most of the systems, a system in space sector.

And what's also important to realize is that it's not just one technology, but many different

And in terms of security, what is required is a skill set of pretty much anything and everything

you can think of in terms of cyber security, because the nodes and the systems we are trying

to protect are anything from the hardware components to web applications or cloud infrastructure

in many different technologies stack, many different hardware devices, many different operational

So that's on one head is very interesting because if you get into space cybersecurity, you're

going to get to play with any technology you can think of.

On the other head, it's also quite challenging because there are no people who

know everything, so often the Dines are composed of many different skill set experts.

And all that is wrapped around the knowledge of space operations and space technology in general.

We'll take a quick break now. See you and a few.

Calculating route to avoid seeing poverty. Turn left to bypass the unhoused youth sleeping on

the street. Then keep right to skip by the lines of people waiting for food.

Steer clear of the crowded shelter turning people away, then take the exit.

Let's stop looking away and get in the way of rising poverty.

Your donations help the United Way fight poverty in thousands of ways,

like providing food, shelter, and crisis prevention. Donate today at United WayGT.org.

Yes, you can have an enterprise network that's secure and reliable and high performance.

And no, you don't need to choose the best two out of three.

With Meter, you can get the end-to-end network built from the ground up, fast to deploy, and easy to manage.

That's because Meter is software-led for easy installation, maintenance, and control for everything running on your enterprise network.

Hardware, firmware, and software all working together from the start seamlessly on a unified platform that's secure by design.

You can't protect what you don't know exists, which is why Meter gives you comprehensive visibility into wire.

in wireless routing, switching, firewalls, DNS security, and VPNs.

You'll really know what's running on your network down to the most granular client level.

Step off the hardware box upgrade treadmill and switch to Meter for a predictable fee

and free up your team to spend time on all the other things that keep your business running.

Try it out for yourself and book a demo online at meter.com slash cyberwire.

That's M-E-T-E-R dot com slash cyberwire.

Trade ice skating at Nathan Phillips Square for ice cubes in your umbrella drink.

Let Porter Airlines fly you from Toronto Pearson nonstop to 10 top sun destinations in Mexico, the Caribbean, and Costa Rica.

Enjoy award-winning Porter servers Toronto has loved for 20 years and start your vacation as soon as you're on the plane.

your sunny getaway today at flyporter.com and actually enjoy economy.

And now a word from our sponsor, SpectorOps.

Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments,

creating new trust relationships and attack paths.

Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one

identify the choke points that matter most and bring trusted attack path intelligence into approved

AI workflows with Bloodhound Hunter. See how SpectorOps helps teams secure the AI-driven identity

Welcome back. Let's return now to my conversation with Melancho Starchick and Andy Olcawa from

Vision Space. Here's Melenko now on what an infosecic professional needs to understand.

Understanding how a space mission works is something that is quite important.

And to understand that not all the systems are, like a breach in one system might have a different

impact on the actual mission than a breach in another system.

Like if a web server is breached and there is some malicious files hosted on that server,

for example, that might have for the actual satellite, no effect at all.

might give a bad perception or something,

but for the actual satellite, it's not harmful.

But if you manage to break into the mission control system

you can suddenly send commands to the actual spacecraft

without requiring a ground station on your own.

It's like, do I need to know radio?

Do I need to have an antenna to do this kind of stuff?

but most of the attack surface is on the ground

because also most of the users are on the ground

and the spacecraft itself does not take any actions

still the primary entrance into these kind of systems, no matter how well they are protected.

Makes sense. And just in terms of pure numbers and volume there, although I'm thinking also of

everybody wants to go, I hacked a satellite. It's not as sexy to go, I hacked a ground station.

Yeah, that's true. It's true. I mean, there's an element of that, right? Like, it's the cool

factor of, like, I want to hack a satellite. But at the same time, I mean, you've both mentioned

ground stations so many times, and that makes so much sense that that is a major entry point.

That's the point at which one must also deploy defenses.

And I'm curious in terms of overlapping skill sets with, say, OT, for example,

is it almost a one-to-one skill set there?

If someone's an OT professional, can they kind of seamlessly slot in space cyber in that case,

or is it a very rarefied set of knowledge there?

So I would say that OT is a subset of what a space mission and cybersecurity for space machine

would look like because if you are talking for instance if you are talking ground

station there is a lot of there might be a lot of devices which are responsible for

controlling the actual satellite dish and other other equipment so that's like a typical

of the ICS the sector but that's just that's just one element of space mission then we have

you know we have a machine control system where which which is usually in

standard cloud or -premise infrastructure with a standard Windows or Linux or

Linguip separating systems or both standard software development stacks applications

and in Java in C++ in Python so just that's what I said at the beginning the

skill set is is pretty much everything you can think of yeah I would say that it's less of

It's more like if you want to do the full chain,

because no one can be the super expert on embedded security,

at the same time be an expert on cloud pen testing

So I think that's what makes it interesting.

Of course, it's not a 100% overlap with OT.

Because, for example, when we look at the protocols,

so we might have in a ground station, of course, just regular OT hardware.

But if we go to the satellite communication itself or onboard the satellite,

the communication, there might be different bus systems used,

So there will be definitely some learning required to understand these new protocols.

Even the communication between, even the communication, because all of the communication,

And even the communication between the ground station and mission control, even though it is on ground,

So for instance, the communication doesn't go through HTTP, right?

It goes to TCP, but they have specific protocols.

So, you know, this might be something that one might need to learn.

In the end, it's going to be TCP and it's going to be so sort of protocol.

And someone will have to learn it and then hack on it.

And that's T-minus space cyber briefing brought to you by N2K Cyberwire.

episode, a reminder that this conversation with Melancho and Andy is not done. It continues in week's

episode, in fact. So week, part two of my space cybersecurity fundamentals chat with Milanko

Star Trek and Andy Olcawa of Vision Space. Make sure to tune in. Now, if you liked what you heard

today, you will also enjoy our , Signals and Space. You'll get research and notes pulled

together by our producer Ethan Cook and me, along with this week's top space cyber news stories.

podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly

changing cybersecurity landscape. If you like the show, please a rating and review in your

podcast app. Please also fill out the survey in the show notes or send an email to space at n2k.com.

We're proud that N2K Cyberwire is part of the daily routine of the most influential leaders and

operators in the public and private sector, from the Fortune 500 to many of the world's

preeminent intelligence and law enforcement agencies. N2K helps cybersecurity professionals grow,

learn, and stay informed. As the nexus for discovery and connection, we bring you the people,

the technology, and the ideas shaping the future of secure innovation. Learn how at n2K.com.

Thank you for listening to T-minis. I am your host, Maria Vermasasas. The show is produced by

Calculating route to avoid seeing poverty.

Then keep right to skip by the lines of people

turning people away, then take the exit.

Let's stop looking away and get in the way of rising poverty.

Your donations help the United Way fight poverty in thousands of ways,

like providing food, shelter, and crisis prevention.

What does a sunny getaway with Air Canada sound like?

Rio comes alive long after the sun goes down.

And just when you think you've heard it all,

Book hot fairs and vacation packages today.

There aren't yet for this episode. Click on any sentence in the transcript to .