Threat Assessment and Remediation Analysis for Nanosatellite On Board Computers

Threat Assessment and Remediation Analysis for Nanosatellite On Board Computers

Speakers: Klara(ChaeYoung) Kim; Donavan Cheah (Sopos execure works)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=Rswow_nKaDE

Overview

In an era of rapidly expanding space exploration and commercialization, the cybersecurity of orbital assets has become a critical, yet often overlooked, concern. This talk, delivered by Klara(ChaeYoung) Kim and Donavan Cheah, delves into the burgeoning threat landscape surrounding nano-satellites and their onboard computers (OBCs). The presentation highlights the unique challenges of securing these small, cost-effective spacecraft, which are increasingly deployed by diverse entities ranging from universities to private companies and even hobbyists.

The speakers, members of "Team Set Crack" – a research group dedicated to space systems cybersecurity – meticulously outline why security often takes a backseat in nano-satellite development. They introduce a robust methodology combining MITRE ATT&CK for Embedded (MITRE Embed) and Threat Assessment and Remediation Analysis (TARA) to systematically identify, assess, and mitigate risks. This analytical approach aims to foster "security by design," ensuring that these vital orbital assets can fulfill their missions without succumbing to preventable cyber incidents, thereby protecting invaluable data and national security interests.

Background

▶ Watch: Overview of cyber security in space and nano-satellites (3:30)

The space industry is undergoing a significant transformation, characterized by the proliferation of nano-satellites and CubeSats. These compact, affordable spacecraft, costing between $50,000 to $150,000 (a fraction of traditional satellite missions), have democratized access to space. As of this year, nearly 3,000 nano-satellites have been launched, with approximately nine new satellites entering orbit every day. The vast majority, around 90%, are CubeSats. While many originate from the United States, multinational collaborations are increasingly common, blurring geographical lines of ownership.

Despite their rapid deployment and critical applications, the security posture of these orbital assets is alarmingly weak. This vulnerability stems from several interconnected factors. First, the tight budgets and aggressive deadlines inherent in nano-satellite development often prioritize functionality, communication, power management, and radiation hardening over cybersecurity. Teams are primarily focused on ensuring the satellite launches and collects useful data, leaving security as an afterthought.

Second, the small form factor of nano-satellites imposes severe limitations on their OBCs. These are typically low-powered microcontrollers with constrained processing capabilities and, critically, often lack memory management units (MMUs). The absence of MMUs means there is no process isolation or user-kernel separation, making the entire system susceptible to compromise if any single process is breached. This architectural deficiency fundamentally undermines robust security.

Third, the supply chain for nano-satellite components is often fragmented and unregulated. Many parts are bought off-the-shelf, sometimes from sources with questionable security practices, without rigorous vetting. This "buy-and-integrate" approach introduces inherent vulnerabilities. The speakers cited a concerning example from an open-source project where developers left comments like "I'm too lazy to check" regarding critical features like readout protection, illustrating a pervasive lack of security diligence.

Furthermore, the shared nature of Earth's orbits creates a complex, multi-tenant environment. Civilian, research, and military satellites coexist, with some exhibiting dual-use capabilities. This intermingling of assets with varying security needs and mission objectives significantly expands the attack surface. Historical incidents underscore these risks: a 1999 breach of NASA systems by a "kid" (though criticality disputed by NASA) highlighted the vulnerability of space infrastructure, and the 2024 loss of an Intelsat satellite, while speculative in cause, serves as a stark reminder of potential mission failures, whether cyber-related or not. The cultural shift in satellite security has lagged behind the technological and commercial evolution, leaving a critical gap that demands immediate attention.

Key Findings

▶ Watch: Past satellite cyber attacks and incidents (11:00)

The core issue identified by Klara Kim and Donavan Cheah is the growing disparity between the rapid proliferation and critical importance of nano-satellites and the persistent neglect of their cybersecurity. Driven by cost, time, and hardware constraints, security is consistently deprioritized during development, creating a vast and vulnerable attack surface in space. This oversight carries severe consequences, including mission loss, compromise of scientific or commercial data, and even implications for national security through debris creation or collision risks.

To address this systemic problem, the speakers propose a structured, systematic approach to threat modeling through the integrated application of two powerful frameworks: MITRE ATT&CK for Embedded (MITRE Embed) and Threat Assessment and Remediation Analysis (TARA). This combination allows for a comprehensive, quantitative evaluation of threats, enabling developers to build "security by design" into nano-satellites from the earliest stages of mission planning.

A critical finding from their analysis is the extreme danger posed by latent hardware debug ports (such as JTAG or SWD) and avenues for unauthorized firmware access. The primary risk associated with these interfaces is not post-launch exploitation – as physical access becomes impossible – but rather pre-launch tampering. During manufacturing, integration, testing, or even student lab work, an attacker could exploit these ports to extract firmware, modify the bootloader, or plant permanent backdoors. Once the satellite is in orbit, such compromises become irreversible, with no physical reset or recovery options.

Ultimately, the research demonstrates that despite the inherent limitations of nano-satellite platforms, achieving robust security is entirely feasible. By focusing on foundational mitigations, such as permanently disabling debug ports and enabling hardware readout protection, developers can significantly enhance the resilience of their spacecraft. This proactive, constraint-aware approach ensures mission safety and integrity without unduly burdening the development process.

Technical Deep Dive

▶ Watch: Applying MITRE Embed and TARA for threat analysis (22:00)

Securing nano-satellites necessitates a deep understanding of their unique architecture and the constraints under which their onboard computers (OBCs) operate. Donavan Cheah began by outlining the core components common to most nano-satellites. The OBC functions as the "brain," performing central control and subsystem management, essential for orchestrating the various modules. The communications subsystem handles uplink (ground-to-satellite) and downlink (satellite-to-ground) transmissions, vital for data transfer and receiving commands. Payloads are mission-specific, such as scientific instruments or data collectors. The Altitude Determination and Control System (ADCS) is crucial for maintaining the satellite's correct orbit and orientation. Finally, the Electrical Power System (EPS) manages power distribution, including harvesting energy from solar panels.

A significant technical challenge lies in the nature of the OBC itself. These are typically very low-powered microcontrollers, small in form factor, especially in CubeSats. A critical revelation is that many CubeSat OBCs lack memory management units (MMUs). This absence leads to fundamental security weaknesses: no process isolation and no user-kernel separation. Consequently, a compromise in one part of the system can potentially affect the entire OBC's memory and operations, making it highly vulnerable. Furthermore, there's no industry-standard operating system; while FreeRTOS (a real-time operating system or RTOS) is common, some entities use embedded Windows, and even modified Arduino versions have found their way into space, contributing to a fragmented and inconsistent security landscape.

To tackle these complexities, the speakers advocated for a structured threat modeling approach. Threat modeling, as summarized by the Threat Modeling Manifesto, involves four key questions: What are we working on (scope)? What can go wrong (threat identification)? What are we going to do about it (mitigation)? And did we do a good enough job (verification)? This systematic process is particularly challenging in the satellite domain due to limited computational resources, complex attack surfaces involving various communication channels (e.g., UART), and significant patch limitations once a satellite is in orbit.

The core of their proposed solution lies in integrating two specialized frameworks: MITRE ATT&CK for Embedded (MITRE Embed) and Threat Assessment and Remediation Analysis (TARA).

MITRE Embed, officially released in September of the previous year, is a relatively new framework specifically designed for embedded systems, including IoT devices, robots, and satellites. It leverages the STIX 2.1 format, making its data structured and machine-readable for automated threat mapping and analysis. MITRE Embed operates on a simple principle: connecting Properties (P), Threats (T), and Mitigations (MID). Its three-step process involves:

1. Identifying Device Properties: Cataloging hardware components like microprocessors, memory subsystems, and hardware access ports.
2. Mapping Properties to Threats: Using the MITRE Embed threat catalog to identify potential threats associated with each property (e.g., a microprocessor might map to four main threats, a hardware access port like JTAG or SWD to three).
3. Identifying Mitigations: Suggesting countermeasures for the identified threats.

For nano-satellites, MITRE Embed is invaluable because it directly links design features to real threats and mitigations, enabling "security by design" from the mission planning phase.

TARA, traditionally used in the automotive industry, provides a quantitative method to prioritize and manage risks. Its application to satellites is crucial given that a single vulnerability can lead to total mission loss, irreversible data loss, and significant financial write-offs. TARA helps convert qualitative threats into quantifiable risk values and complements MITRE Embed by assessing likelihood, impact, and mitigation effectiveness. The four steps of TARA include:

1. Identify Assets and Threats: Leveraging the threat mapping from MITRE Embed.
2. Assess Exposure and Feasibility: Evaluating the likelihood of exploitation. This is unique for satellites because physical access is impossible post-launch, making RF links and pre-launch insider threats the primary attack vectors. Resource limitations also influence the realism of an attack.
3. Estimate Impact: Determining the consequences of a successful attack.
4. Determine Risk and Prioritize Mitigations: Using a scoring system.

The integration workflow begins by defining the system scope, extracting properties from the OBC datasheet (CPU, memory, interfaces, firmware, sensors), and classifying them into Embed's property categories. These properties are then mapped to Embed's threat catalog. Next, TARA's model is applied to score each identified threat based on its likelihood and impact. Each attack vector receives a risk score derived from a weighted combination of five factors: locality (0.2), confidentiality impact (0.2), availability impact (0.2), prior use (0.3), and stealth (0.1). Each factor is scored low, medium, or high.

A key example highlighted was Threat ID T1119 (latent hardware debug port issue), which scored highest at 3.0. This threat, along with T1115 (unauthorized firmware access), was shown to be extremely dangerous because debug ports like JTAG and SWD provide full memory and code access. The critical insight is that the true risk isn't post-launch exploitation but pre-launch access during manufacturing, integration, or testing. If an attacker extracts firmware, modifies the bootloader, or plants a backdoor at this stage, it becomes a permanent, unfixable vulnerability once the satellite is in orbit.

The foundational mitigations recommended by Embed for such threats include permanently disabling all debug ports and enabling hardware readout protection. These are not optional but essential minimal protections. The process also incorporates a mitigation maturity score, which, when multiplied by the threat maturity score, helps prioritize which mitigations are most significant. Finally, a countermeasure table combines these prioritized mitigations with a cost index and effectiveness rating (preventive or mitigative), providing a practical catalog for implementation.

Demo / Proof of Concept

▶ Watch: Prioritizing and scoring nano-satellite threats with TARA (30:00)

The presentation included a demonstration of a prototype tool called the "cubesat advanced threat in compliance kit" (also referred to as the "set check tool"). This tool embodies the integrated MITRE Embed and TARA methodology, offering a practical solution for nano-satellite developers.

The prototype works by taking a target file, specifically a JSON representation of an OBC's datasheet. This datasheet contains detailed information about the OBC's properties, such as its CPU, memory, interfaces, firmware, and sensors. Upon ingestion, the tool analyzes these properties and, leveraging the Embed framework, identifies possible matching threats. It then applies the TARA methodology to prioritize these threats based on their calculated risk scores.

The tool provides a visualized output, showing threat levels and property categories, making it intuitive for teams to understand which areas require immediate attention. Users can click on specific threat IDs to reveal suggested mitigations, categorized by their maturity (foundational, intermediate) and their alignment with relevant compliance standards, such as IEC 62443. This feature is crucial for ensuring that implemented mitigations meet industry and regulatory requirements.

While the speakers emphasized that they have not yet "hacked an orbiting satellite," this prototype demonstrates a significant step towards enabling responsible validation of attacks and building security into the design phase. The tool is currently a prototype and not publicly available, but the team plans to release it on GitHub, alongside the development of a real hardware testbed to further validate their findings and proposed mitigations. This proof of concept effectively bridges the theoretical threat modeling frameworks with a practical, actionable application for the nano-satellite community.

Defensive Implications

▶ Watch: Audience Q&A: When are satellites most vulnerable to attack? (40:00)

The detailed analysis presented by Klara Kim and Donavan Cheah provides clear and actionable defensive implications for anyone involved in the design, development, and operation of nano-satellites. The overarching message is the critical need to shift from a reactive, afterthought security approach to one of "security by design."

Firstly, integrate security from the earliest mission planning phases. Given the inherent constraints on power, computing, and memory in nano-satellites, security solutions must be lightweight and built into the system architecture, rather than bolted on later. This proactive integration ensures that security considerations are fundamental to design decisions, rather than being compromised by budget and time pressures.

Secondly, adopt structured and quantitative threat modeling. The combined MITRE Embed and TARA framework offers a systematic way to identify, analyze, and prioritize threats. By converting qualitative threats into quantitative risk values, development teams can make informed decisions about where to allocate limited resources, focusing on the most impactful and feasible threats. This analytical rigor is a significant upgrade from ad-hoc security assessments.

Thirdly, prioritize pre-launch security measures across the entire supply chain. The research unequivocally highlights that the most significant attack surface for nano-satellites is often before launch. This includes securing manufacturing processes, integration stages, and testing environments. Defenders must implement stringent controls to prevent unauthorized access, firmware tampering, or the injection of backdoors during these critical phases.

Fourthly, implement foundational hardware security features as non-negotiables. Specifically, permanently disabling all hardware debug ports (like JTAG and SWD) and enabling hardware readout protection on the OBC and other critical components are paramount. These measures are the absolute minimum required to prevent attackers from gaining full memory and code access, which, if exploited pre-launch, leads to permanent and unrecoverable vulnerabilities in orbit.

Finally, recognize and adapt to the unique operational constraints of space assets. The inability to constantly communicate with satellites, apply patches, or perform physical resets means traditional IT security practices like continuous vulnerability management are not directly transferable. Security solutions must be resilient to intermittent connectivity and designed for long-term, autonomous operation, emphasizing robust initial hardening and carefully considered remote update mechanisms. The goal is to build a satellite that is secure enough to carry out its mission safely and reliably, acknowledging that second chances are not an option once in orbit.

Key Takeaways

• Nano-satellite proliferation has outpaced security considerations, creating a vast and vulnerable attack surface in space due to tight budgets, limited resources, and a historical lack of security focus.
• The integrated application of MITRE ATT&CK for Embedded (MITRE Embed) and Threat Assessment and Remediation Analysis (TARA) provides a structured, quantitative, and effective framework for threat modeling tailored to the unique constraints of nano-satellite development.
• Pre-launch security is paramount; the most critical attack vector often involves tampering or backdoor injection during manufacturing, integration, or testing, which becomes irreversible once the satellite is in orbit.
• Foundational hardware security measures, such as permanently disabling debug ports (JTAG, SWD) and enabling hardware readout protection on the onboard computer (OBC), are non-negotiable to prevent unauthorized firmware access and ensure mission integrity.
• Achieving "security by design" for nano-satellites is both feasible and essential, allowing these critical assets to safely fulfill their missions without succumbing to preventable cyber risks, thereby protecting valuable data and the space environment.

About the Speaker(s)

Klara(ChaeYoung) Kim is a cybersecurity researcher and an alumna of the esteemed Best of the Best (BOB) program. Holding a bachelor's degree in information security, she specializes in threat modeling and consulting across various emerging technologies, including robotics and CubeSats.

Donavan Cheah is a cybersecurity professional with over 10 years of experience, currently working with Sopos execure works. He is a member of "Team Set Crack," a research group dedicated to the cybersecurity of space systems, and has previously participated in the Global Cyber Security Camp.