Lowering the Orbit - Exploiting Proprietary Satellite Protocols via Software Defined Radio and GS

Romel Marin opens with the gap that motivated the project. Space protocol documentation is easy to find, but there is no legal satellite to practice radio attacks against, and the number of active spacecraft keeps growing. He covers the basics a newcomer needs: a satellite as a computer in orbit, telemetry, telecommands and payload data, the link between space and ground segments, and the CCSDS standards with the Space Packet Protocol structure.

The core of the talk is PWNSAT, an open-source platform of intentionally vulnerable hardware. He describes its three versions, ending with a CubeSat built from a flight computer that runs Linux, a LoRa radio board and a power board, plus a plug-and-play ground station application. The demonstrations use a cheap RTL-SDR receiver to capture unencrypted downlink traffic and decode the packets. He then brute-forces application process identifiers over the Space Packet Protocol, much as directory scanning works against web applications, injects captured data back into the link, and fuzzes the firmware to trigger a denial of service.

The takeaway is that the downlink in these demos carries no cryptography, so anyone designing or assessing a space link should treat the radio path as an attack surface. He publishes the scripts, firmware, PCB designs and step-by-step walkthroughs on GitHub, along with about 34 documented vulnerabilities. He stresses that the tools are meant for lab hardware like his, not for real spacecraft.