Burning, Trashing, Spacecraft Crashing

Overview: Mileno Starc and André from VisionSpace present an in-depth security assessment of open-source software frameworks powering modern satellite ground stations and flight operations. The speakers investigate how the rapid proliferation of commercial nanosatellite constellations and defense space assets has outpaced software security practices. The presentation reveals critical vulnerabilities across mission control systems and flight software, demonstrating how chained ground-segment web flaws and flight-segment memory corruptions can compromise active spacecraft.

Key Topics: - Satellite ground segment and onboard flight software attack surfaces - Stored cross-site scripting and telecommand injection in Yamcs - Remote code execution via GOT overwrite in NASA core Flight System (cFS) - Systematic vulnerabilities in Open MCT, OpenC3 COSMOS, and CryptoLib

Technical Details: The researchers examined widely adopted open-source ground segment and flight control software, including Yamcs, NASA's Open MCT, OpenC3 COSMOS, and NASA's core Flight System (cFS). In Yamcs—a ground mission control framework used for small satellites, lunar rovers, and ISS robotic arm operations—the authors identified a stored cross-site scripting (XSS) vulnerability within its telemetry scripting interface. By embedding unencoded HTML tags and malicious JavaScript within script files, an attacker targeting an operator workstation can execute arbitrary code inside the operator's authenticated browser session. This session invokes the Yamcs REST API to issue unauthorized telecommands directly to an orbiting spacecraft, which the authors demonstrated by triggering an uncommanded orbital transition maneuver that deviated a simulated satellite from low Earth orbit toward medium Earth orbit.

Beyond ground systems, the researchers demonstrated remote code execution on the spacecraft's flight computer running NASA's cFS on Linux. Exploiting a vulnerability in the cFS Memory Management (MM) module via uplinked telecommands, the authors performed arbitrary memory reads and writes across the cFS process space. By systematically leaking libc addresses over downlink telemetry, the exploit located the address of `memchr` within the Global Offset Table (GOT) and replaced it with `system()`. Uplinking a subsequent telecommand triggered the hijacked pointer, yielding a live reverse shell directly on the spacecraft's flight computer.

Additional vulnerabilities uncovered across the space software ecosystem include prototype pollution in NASA's Open MCT, arbitrary local file deletion in Yamcs, container takeover through RCE in OpenC3 COSMOS, and unsafe Python pickle deserialization in AIT Core. Furthermore, testing of CryptoLib—a modular cFS plug-in intended to provide telemetry and telecommand encryption, authentication, and session key management—revealed that malformed, unauthenticated telecommands cause complete onboard software crashes and reboots. If improperly configured, these reboots force CryptoLib to reset its cryptographic keys to all zeros, completely neutralizing uplink authentication and encryption.

Key Takeaways: Space mission operators must eliminate reliance on perimeter security by implementing end-to-end cryptographic command authentication and anti-replay protection, such as CCSDS Space Data Link Security (SDLS), directly on the spacecraft. Ground segment web applications like Yamcs must enforce strict output encoding, input validation, and strong Content Security Policies to block telecommand-dispatching XSS exploits. Flight software modules, particularly memory management and cryptographic libraries, must undergo rigorous binary auditing, memory-safe refactoring, and secure fallback key-management validation.

(AI summary — Gemini Flash)