Hacking Space to Defend It: Generating IoBs with SPARTA

Hacking Space to Defend It: Generating IoBs with SPARTA

Speakers: Brandon Bailey

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=UL_c4K5dTuc

Overview

In an increasingly space-dependent world, securing orbital assets against cyber threats is paramount. Brandon Bailey's DEF CON talk, "Hacking Space to Defend It: Generating IoBs with SPARTA," addresses this critical challenge by introducing a groundbreaking methodology for developing robust intrusion detection capabilities for spacecraft. The presentation centers on the Space Attack Research and Tactic Analysis (SPARTA) framework, an adaptation of MITRE ATT&CK tailored for space systems, and its novel extension: Indicators of Behavior (IoBs).

Bailey, a seasoned expert in spacecraft cybersecurity with a background in NASA and extensive penetration testing, highlights the dire need for proactive security measures in an environment historically lacking dedicated cyber defenses. Unlike terrestrial systems with vast datasets of past attacks, space systems operate in a relatively uncharted cyber threat landscape, necessitating a predictive approach to threat modeling and detection. This talk details how SPARTA's IoBs provide the crucial "what to look for" that has long eluded space system developers, enabling the creation of on-board intrusion detection systems capable of identifying and responding to sophisticated attacks.

The significance of this work extends beyond mere detection, emphasizing the imperative for autonomous response in a domain where traditional human-in-the-loop mitigation is often too slow to prevent catastrophic outcomes. By translating theoretical attack patterns into actionable behavioral indicators, Bailey and his team at Aerospace Corp are not only advancing the state of space cybersecurity but also laying the groundwork for resilient, self-defending spacecraft, ensuring the continued integrity and availability of vital space infrastructure.

Background

▶ Watch: Introducing SPARTA: MITRE ATT&CK for space systems (0:40)

The landscape of cybersecurity for space systems presents unique challenges that differentiate it significantly from traditional terrestrial IT environments. For decades, spacecraft have been designed with an emphasis on reliability and fault tolerance against environmental factors, but often without a dedicated focus on malicious cyber intrusions. As Brandon Bailey notes, "there are not a lot of detect type capabilities built into spacecraft." Existing fault management systems (FMS) are primarily geared towards handling randomized, environmental faults and typically "don't consider security as a part of one of those fault methods" [04:00]. This oversight leaves a critical gap in the defensive posture of these complex, often remote, and high-value assets.

Recognizing this void, Aerospace Corp, an FFRDC (Federally Funded Research and Development Center) akin to MITRE, embarked on developing a specialized threat modeling framework. Inspired by the widely adopted MITRE ATT&CK framework, which documents known adversary tactics, techniques, and procedures (TTPs) for enterprise and industrial control systems, they created SPARTA. Published in October 2022, SPARTA extends this methodology to the space domain, covering everything from electronic warfare (EW) and anti-satellite (ASAT) capabilities to deep cyber threats, with a strong emphasis on cyber aspects. A key differentiator for SPARTA, however, is its forward-looking approach. While MITRE ATT&CK largely documents past attacks, SPARTA aims to "project and theorize what attackers could do in the realm with space systems" [02:00], given the limited historical data of space-specific cyber incidents. This red-informed blue strategy is designed to drive the development of countermeasures and requirements, providing "shell statements for people that do system engineering" [02:00].

The immediate next challenge after establishing a comprehensive threat model was to translate these theoretical attacks into actionable detection mechanisms. Previous research by Bailey's team had confirmed the feasibility of intrusion detection on spacecraft, but the question remained: "what do you look for?" [04:00]. Traditional Indicators of Compromise (IoCs), such as file hashes, IP addresses, or domain names, are often too specific and reactive for the space environment, which lacks the rich logging and network visibility common in terrestrial systems. This necessity led to the adoption and extension of Indicators of Behavior (IoBs), a less-known concept within the STIX framework standard by Oasis. IoBs, being probabilistic and behavioral-based, offer a higher level of abstraction, making them ideally suited for identifying anomalous activities on spacecraft where direct forensic artifacts might be scarce or delayed. The goal was to decompose SPARTA techniques into IoBs to facilitate detection engineering for future space missions, funded partly by the Department of Homeland Security S&T Directorate.

Key Findings

▶ Watch: Introducing Indicators of Behavior (IoBs) for spacecraft detection (2:50)

The core findings presented in this talk revolve around the successful development, validation, and scalability of Indicators of Behavior (IoBs) derived from the SPARTA framework for space systems. This research addresses the critical gap of "what to look for" in spacecraft intrusion detection.

Firstly, the team successfully generated approximately 200 IoBs by April 2023, meticulously decomposing the "most dangerous, impactful, likely techniques" [06:00] identified within the 215 SPARTA techniques. This process was not purely theoretical; it involved extensive red teaming, including attacks on digital twins, flatsats, and leveraging over a decade of space system penetration testing experience. These IoBs are now integrated into the SPARTA website, accessible under "related work" and as a dedicated tab for each technique, providing a description, a STIX pattern, and correlated techniques to guide developers.

Secondly, the talk demonstrates the practical utility and feasibility of building on-board intrusion detection systems (IDS) based on these IoBs. A key experiment involved the creation of Space Cop, a custom IDS, which successfully implemented about 30 of the initial 200 IoBs. This IDS was deployed on NOSC3D, a NASA open-source digital twin of a CubeSat, and successfully detected simulated attacks, such as a time spoofing command and the execution of rogue malware. Crucially, the performance impact of Space Cop on the spacecraft's resource utilization was found to be "pretty negligible" [12:00], addressing a common concern about adding more software to resource-constrained space vehicles.

Thirdly, the research confirmed the scalability of IoB mapping to real-world missions with mission-specific data. Despite the tens of thousands of mnemonics and telemetry items on a typical spacecraft, a real mission team successfully translated all 200 generic IoBs into specific telemetry items. This process was significantly expedited and made scalable through the use of AI and machine learning capabilities, which automated the mapping of IoBs to roughly 90,000 different mnemonics. This finding directly counters the anticipated industry pushback regarding the manual effort required for such mapping. The integrated detection capability was demonstrated using Aerospace Corp's DAR application, an existing ground-based IDS now enhanced for cyber intrusion monitoring.

Finally, the project proved that these IoBs are effective against more advanced threats, including on-board malware and persistent threats. The demonstration of detecting a rogue CFS application, "Blackout," and its subsequent execution of ransomware, confirmed that the IoBs can effectively identify malicious updates, supply chain injections, and the execution of unauthorized code. This comprehensive validation underscores the transformative potential of IoBs in establishing robust, predictive cybersecurity for the space domain.

Technical Deep Dive

▶ Watch: Why IoBs are critical for spacecraft intrusion detection (4:10)

The technical foundation of this work rests squarely on the SPARTA framework, an adaptation of MITRE ATT&CK for the space domain. SPARTA provides a comprehensive lexicon for communicating Tactics, Techniques, and Procedures (TTPs) specific to space systems, encompassing everything from electronic warfare and anti-satellite operations to deep cyber intrusions. Unlike its terrestrial counterpart, SPARTA is designed not just to document past attacks but to "project and theorize what attackers could do" [02:00] in a domain with limited historical cyber incident data. This forward-looking approach is crucial for driving blue team defenses and system engineering requirements.

Central to the talk is the concept of Indicators of Behavior (IoBs), which are positioned as a higher-level abstraction than traditional Indicators of Compromise (IoCs). While IoCs (e.g., file hashes, IP addresses, domain names) represent "known knowns" and are typically reactive, IoBs operate in the "probabilistic area" [05:00], focusing on behavioral patterns. This is essential for space systems where direct forensic artifacts might be limited, and detection needs to be based on anomalous functional behavior rather than specific malware signatures. IoBs are designed to inform intrusion detection type capabilities on space vehicles, a significant departure from the traditional fault management systems (FMS) that historically overlook security-related faults.

The development of the 200 IoBs involved a rigorous process of red teaming against various space system emulations, including digital twins (like NASA's NOSC3D) and flatsats, combined with extensive real-world penetration testing experience. The IoBs are structured using the STIX (Structured Threat Information eXpression) framework, a standardized language for cyber threat intelligence. However, a significant technical hurdle identified was that many "observables" specific to space vehicles (e.g., telemetry mnemonics, bus traffic, subsystem states) "don't show up in the STIX standard" [08:00]. This necessitated a collaborative effort with Oasis and the Space ISAC to extend the STIX standard to include space observables, ensuring a more comprehensive and accurate representation of space-specific threat data.

The 200 IoBs are categorized into 10 groups, reflecting the most dangerous and impactful SPARTA techniques:

1. Commanding: Unauthorized and anomalous command execution.
2. Crypto Usage: Crypto key manipulation and encryption bypass.
3. Network Exploitation: Communication security breaches.
4. Signals RF Integrity: Authentication and integrity of radio frequency signals.
5. Timing and GNSS: Spoofing or manipulation of Global Navigation Satellite System (GNSS) timing.
6. Memory and Resource Utilization: Attacks targeting onboard memory and system resources.
7. Watchdogs and Registers: Manipulation of system watchdogs and critical registers.
8. Software Integrity: Unauthorized updates, patches, or implants.
9. Sensor Manipulation: Altering sensor data.
10. Data Integrity: Compromising the integrity of stored or transmitted data.

Bailey notes that "it's easier to do the top ones, harder to do the lower ones" [10:00], indicating increasing technical complexity for detection as one moves down the list. Each IoB on the SPARTA website includes a description, the corresponding STIX pattern, and a list of correlated SPARTA techniques, providing a direct link between observed behavior and potential adversarial actions.

The implementation of these IoBs into an actual Intrusion Detection System (IDS), named Space Cop, involved mapping these generic indicators to specific spacecraft telemetry, command logs, and onboard activity. While this mapping can be challenging due to the "tens of thousands of mnemonics and telemetry items" [15:00] on a spacecraft, the team demonstrated that it can be automated using AI and machine learning capabilities. This automated process successfully matched 200 IoBs to approximately 90,000 different mnemonics for a real mission, proving the scalability of the approach. Furthermore, the integration of these IoBs into existing ground-based systems like Aerospace Corp's DAR application, initially designed for signal interference and GPS monitoring, illustrates how cyber intrusion detection can be layered onto existing capabilities.

Demo / Proof of Concept

▶ Watch: Methodology for generating IoBs: Attacking space systems (6:10)

The talk featured compelling demonstrations to validate the efficacy of SPARTA's Indicators of Behavior (IoBs) and the custom-built Space Cop intrusion detection system. These proofs of concept leveraged realistic simulations and attack tools to showcase detection capabilities against both basic and advanced space-specific threats.

The primary testbed for these demonstrations was NOSC3D (NASA Open Source CubeSat Simulator), a digital twin software built by NASA. Bailey, having contributed to NOSC3D's early development, highlighted its utility as a free, open-source platform for ground-to-space simulations. This environment allowed for controlled experimentation without risking actual orbital assets.

The custom IDS developed for these experiments was named Space Cop. The team took a subset of roughly 30 IoBs from the initial 200 identified and implemented them as detection rules within Space Cop. A critical aspect of the IDS development was ensuring a negligible impact on spacecraft resource utilization, a common concern for embedded systems. The first revision of Space Cop indeed showed "negligible" [12:00] impact, addressing this potential barrier to adoption.

The first experiment demonstrated a time spoofing attack, a fundamental yet critical threat in space operations where precise timing is paramount. In the simulation, a command was sent from a ground station to "change the time" [13:00] on the spacecraft, exceeding a defined delta. Space Cop successfully detected this anomalous command. Bailey underscored the real-world implications: in an actual attack, the time spoofing signal would be sent via an RF link, and without an on-board IDS, the anomaly might only be noticed 15 minutes later when telemetry is downlinked, severely limiting response time. This basic demo illustrated the immediate value of on-board detection.

The second, more advanced experiment targeted on-board malware and persistent threats. For this, the team developed a rogue Core Flight System (CFS) application called Blackout, designed to act as an implant on the spacecraft. This simulated a malicious update or a supply chain injection. To execute and control Blackout, they used Space Invader, Aerospace Corp's internal penetration testing tool. Space Invader functions as a man-in-the-middle proxy and a rogue ground station, capable of intercepting, modifying, spoofing, and jamming data, and crucially, communicating with the Blackout application.

The demonstration showed Space Invader uploading the Blackout app to the spacecraft. Upon deployment, the IoBs were designed to trigger detections when the malicious file touched a specific disk area, as such activity in that location should never occur on a deterministic spacecraft. Following the upload, Space Invader sent a command to Blackout, instructing it to "execute ransomware on the spacecraft" [20:00]. The video then displayed multiple detections firing as the ransomware executed, encrypting files and performing various malicious commands. This successful detection of a sophisticated, multi-stage attack involving rogue software and active exploitation validated the IoBs' ability to identify complex behavioral anomalies indicative of advanced persistent threats.

These demonstrations collectively proved that developers, even those not involved in the original IoB creation (like Randy Tenny who built Space Cop), could successfully implement these indicators into an IDS to detect actual attacks on spacecraft systems.

Defensive Implications

▶ Watch: Prioritizing IoB development for impactful space techniques (6:50)

The findings presented in this talk carry profound defensive implications for the space industry, fundamentally shifting the paradigm from reactive fault management to proactive cyber intrusion detection and, critically, autonomous response. Brandon Bailey repeatedly emphasizes that "detection doesn't equal mitigation" [21:00] in the space domain. Due to the inherent latency in communication with orbital assets – where telemetry might only be downlinked every 15 minutes – the "control loop is so low you don't really have time to take any action" [21:00] if an attack is only detected after the fact. This necessitates a fundamental re-evaluation of how security incidents are handled.

The most significant defensive implication is the urgent need for autonomous response capabilities on spacecraft. Just as spacecraft are designed to be autonomous in their operational functions, they must evolve to be autonomous in their security responses. This means integrating cyber intrusion detection directly with existing fault management systems (FMS). By treating cyber intrusions as a type of fault, the spacecraft can leverage its inherent autonomy to "respond as soon as the event is detected if it's one of the more dangerous indicators and detections" [24:00]. This integration would allow for immediate, pre-programmed defensive actions, such as isolating compromised modules, initiating safe modes, or rolling back configurations, without human intervention.

For defenders, this research provides the much-needed "what to look for" through the SPARTA Indicators of Behavior (IoBs). These IoBs offer a concrete framework for developing and implementing on-board intrusion detection systems. Spacecraft developers and mission operators should leverage these IoBs to:

• Design Security from the Ground Up: Incorporate cyber resilience and detection capabilities into the earliest stages of spacecraft design, moving beyond the traditional focus solely on environmental fault tolerance.
• Implement On-Board IDSs: Utilize the generic IoBs to build custom intrusion detection logic tailored to their specific mission data, telemetry, and command structures. The demonstrated scalability with AI/ML mapping of IoBs to mnemonics significantly reduces the engineering lift required for this.
• Integrate with FMS: Develop automated response mechanisms that link IoB detections directly to FMS actions. This means pre-defining responses for critical behavioral anomalies that can be executed autonomously by the spacecraft.
• Extend STIX: Actively participate in efforts with Oasis and the Space ISAC to expand the STIX standard to include space-specific observables, enhancing the common language for cyber threat intelligence in the space domain.
• Utilize Open-Source Tools: Leverage resources like NOSC3D for secure development and testing of on-board security features.

Bailey highlights that Aerospace Corp has advocated for this integrated approach – "automated response integration with fault management is critical" [22:00] – for years, citing a paper he wrote in 2019. The current work on IoBs is a crucial step towards making this vision a reality, providing the foundational detection capabilities necessary for future self-defending spacecraft. The realization that many attacks can render a vehicle "non-recoverable" [24:00] underscores the absolute necessity of this shift towards immediate, autonomous cyber defense.

Key Takeaways

• SPARTA is the MITRE ATT&CK for Space: SPARTA provides a comprehensive, forward-looking framework for threat modeling and communicating TTPs specific to space systems, addressing the unique challenges of a domain with limited historical cyber attack data.
• IoBs are Crucial for Space IDS: Indicators of Behavior (IoBs) offer a higher-level, probabilistic approach to detecting anomalous activity on spacecraft, filling the critical gap of "what to look for" where traditional IoCs are often inadequate.
• On-Board Detection is Feasible and Necessary: The Space Cop IDS, implementing SPARTA-derived IoBs, demonstrated successful detection of both basic (time spoofing) and advanced (on-board malware/ransomware) attacks with negligible resource impact.
• Automated IoB Mapping is Scalable: AI/ML capabilities can automate the translation of generic IoBs to mission-specific telemetry items (e.g., 200 IoBs to 90,000 mnemonics), overcoming the challenge of manual mapping for complex spacecraft.
• Autonomous Response is Imperative: Due to severe communication latency, detection alone is insufficient in space. Integrating cyber intrusion detection with existing fault management systems for immediate, autonomous response is critical for effective mitigation.

About the Speaker(s)

Brandon Bailey is a distinguished expert in spacecraft cybersecurity, with a rich background spanning both government and research sectors. His career includes extensive experience in penetration testing and various aspects of security, notably with a significant focus on NASA work. Currently affiliated with Aerospace Corp, an FFRDC, Bailey has been instrumental in spearheading initiatives like the SPARTA framework. His deep understanding of aerospace systems is evident from his early contributions to the development of NOSC3D, NASA's open-source CubeSat simulator, before transitioning into cybersecurity. Bailey's work consistently emphasizes the practical application of threat intelligence to drive defensive capabilities in the unique and challenging environment of space.