Security Analysis of Open Source Software Used in Onboard Satellite Systems -Rose Idan

The talk starts from the growing reuse of open-source code in satellites, from university CubeSat teams to national space agencies. Space makes fixing that code hard: there is no physical access, updates carry the risk of losing a spacecraft, bandwidth and contact windows are limited, and missions often run for three to five years on software that may no longer be maintained upstream.

The researcher collected 126 publicly available onboard satellite repositories and found that most were abandoned or dormant, including code for satellites still in orbit. Thirteen tools covering SBOM generation, dependency analysis, static analysis and secret scanning were run through one pipeline. About 28,000 raw results were filtered down to roughly 2,800 onboard-relevant findings. Over three quarters of these had real impact. Memory-safety and code-quality issues dominated, with injection and insecure design also prominent. Most findings sat in the onboard computer and payload subsystems, and more than 80 percent came from the projects' own code rather than inherited dependencies. Repositories with more findings tended to have fewer updates.

The practical takeaways are to generate an SBOM, track dependencies, analyze input handling, fuzz flight software before launch, and define a patching procedure that covers the whole mission lifecycle. The speaker said individual findings are not being published while false positives are filtered and affected teams are contacted privately.