How to Hack Satellites | Romel Marin and Kevin Leon

Romel Marín and Kevin León present a comprehensive exploration of satellite cybersecurity, demonstrating practical attack techniques and introducing Pounsat, an open-source learning platform for aerospace security research.

The talk begins with satellite fundamentals: types (communication, navigation/GNSS, Earth observation, scientific, military), orbits (LEO, MEO, GEO), and hardware components (structure, propulsion, communication systems, payload). Satellite software includes mission operating systems (NASA's CoreFly, F Prime), command and control systems, telemetry software, and ground control interfaces. Communication uses uplinks (Earth to space) and downlinks (space to Earth); satellites also use intersatellite communication for constellations like Starlink.

Radio frequency bands are critical to satellite operations: L-band (1–2 GHz) for navigation; S-band (2–4 GHz) for commercial and military telemetry; C-band (4–8 GHz) for television and data; X-band for military and scientific applications; K-band for high-capacity internet; and V-band for experimental systems. Higher frequencies require larger antennas and better equipment. The sub-gigahertz band is gaining adoption for CubeSats using LoRa modulation due to long range and low power requirements.

Context is critical: approximately 12,000 active satellites currently orbit Earth, with 261 launches last year and 150 in the first four months of the current year. By 2030, this is expected to reach 100,000 satellites. This expansion creates security concerns because many operational satellites lack modern security mechanisms, firmware updates are nearly impossible, and the radio frequency segment remains the least documented area in aerospace security—representing the largest unexploited attack surface.

The speakers announce collaboration with Sparta, an aerospace-focused cybersecurity framework similar to MITRE ATT&CK but exclusively documenting space and aerospace incidents. Kevin León describes integrating Sparta with MITRE Flow to create unified attack diagrams for both ground infrastructure and space segments.

Pounsat addresses the lack of realistic satellite security training environments. Unlike NASA's virtual simulations (which use Ethernet without radio frequency), Pounsat is real hardware using actual satellite protocols. It features three segments: a ground station (Raspberry Pi), a space segment (hardware satellite), and a user segment (modem interface). Pounsat uses ISM frequencies (433/800/916 MHz) to avoid legal restrictions and employs the Space Packet Protocol (CCSDS standard) with intentional vulnerabilities for educational purposes. Version 0.1 is operational; version 1.0 will enable users to create their own vulnerable satellites.

The talk demonstrates four main attacks: Signal Interception (capturing unencrypted satellite data using a $20 RTL SDR and GNU Radio), Signal Spoofing/Injection (modifying and injecting analyzed packet structures), Replay Attacks (resending captured packets to test spacecraft ID validation and packet counter protections), and Reverse Engineering/Jamming (analyzing firmware for vulnerabilities and conducting denial-of-service attacks).

Key findings emphasize that satellite cybersecurity is an emerging field with significant gaps in radio frequency security. The combination of legacy systems, limited budgets for updates, and accessible hardware makes satellite security increasingly critical. Pounsat and Sparta provide accessible tools for learning and researching aerospace security. The speakers recommend acquiring low-cost hardware (RTL SDR under $20, antennas, DragonOS), stress obtaining proper authorization before testing, and warn that abandoned but still-transmitting "zombie satellites" present real security risks. The discussion also addresses older satellites still in orbit (typical lifespan six years, development time two to three years) and emerging quantum encryption vulnerabilities that lack adequate testing infrastructure.