HoneySat: A Network-based Satellite Honeypot Framework

HoneySat: A Network-based Satellite Honeypot Framework

Speakers: Efren Lopez-Morales

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=r5aRTcDM7Cc

Overview

This talk presents HoneySat, a high-interaction honeypot framework designed to detect and analyze network-based attacks against satellite ground infrastructure. The system creates believable decoy satellite missions that combine real mission control software with simulated spacecraft and virtual ground stations, enabling defenders to observe attacker behavior in a controlled environment without exposing real mission data. Deployed across five instances -- including one co-located in the address range of an actual mission in Chile -- HoneySat attracted attackers who performed spacecraft component discovery, attempted telemetry data exfiltration, and probed for onboard procedure modification.

A survey of operators found that 9 out of 10 could not distinguish the honeypot from a real mission, and the framework supports 33 out of 38 MITRE Space ATT&CK techniques. In a novel extension, HoneySat was connected to a real satellite, synchronizing honeypot interactions with actual RF transmissions to defeat attackers who might be monitoring the spectrum near a ground station.

Background

▶ Watch: Deception in space security: honeypot design objectives (0:00)

Space-related infrastructure has become an increasingly attractive target for cyber operations. Notable incidents include the Viasat attack (2022), APT groups targeting aerospace companies, attempted breaches of Starlink infrastructure, and the historical ROSAT incident (1990s) where a network intrusion of ground infrastructure was associated with an unexplained attitude change that permanently damaged the satellite's X-ray sensor. Three of these four incidents involved network-based attacks on ground infrastructure rather than RF attacks on the satellite link itself.

Honeypots are deception tools that lure attackers into controlled, instrumented decoy systems to study their behavior. They are classified as high-interaction (providing real tools and realistic interfaces) or low-interaction (offering limited simulated services). For satellite missions, high-interaction honeypots are particularly important because attackers need to be deceived long enough to reveal their techniques, and the honeypot must not disclose information about the real mission -- compromising the honeypot should not help an attacker compromise the actual satellite.

Satellite missions consist of a spacecraft (with platform subsystems like command handling, power distribution, and attitude control, plus a payload for the actual mission purpose) and a ground segment (mission control servers, operator workstations, and ground stations). Communication occurs through telecommand (ground-to-satellite commands) and telemetry (satellite-to-ground data). HoneySat targets the realistic attacker scenario of compromised credentials for remote access to the mission control network.

Key Findings

▶ Watch: Satellite mission architecture: telecommand, telemetry, ground segment (4:00)

• 9 out of 10 surveyed satellite operators could not distinguish HoneySat from a real mission after interacting with the system
• The framework supports 33 out of 38 MITRE Space ATT&CK techniques, covering a broad range of realistic space-targeted attacks
• Five deployment instances were operated: four on cloud infrastructure and one co-located with an actual mission at a university in Chile, configured to mimic that real mission's characteristics
• Mock missions based on NASA and DLR (German Aerospace Agency) configurations were deployed alongside the Chile-based deployment
• All attackers who reached the mission control system performed spacecraft component discovery as their first technique
• One notable attack chain included: mapping the ground segment, attempting exfiltration of downlinked telemetry data, probing spacecraft availability, and attempting to modify onboard procedures
• A fake internal mission website with weak credentials was the most effective lure for attracting attackers, outperforming exposed mission control web interfaces and ground station configuration pages
• Satellite-in-the-loop testing was successfully demonstrated by connecting HoneySat to a real satellite, synchronizing honeypot interactions with actual RF transmissions visible on the spectrum
• The framework is configuration-driven: new mock missions can be set up through personality files describing spacecraft properties and ground configurations without requiring software changes

Technical Deep Dive

▶ Watch: Satellite personality configuration and ground infrastructure deception (8:00)

Spacecraft Simulation Architecture. The simulated spacecraft uses a hybrid interaction model. Command and data handling uses high-interaction components running real flight software that processes telecommands and generates telemetry responses. Other subsystems (attitude control, power distribution, thermal management) use low-interaction script-based behavior simulations that model realistic sensor outputs and state changes in response to commands.

The subsystem simulations connect to physics simulations that model orbital mechanics, thermal behavior, power generation (based on solar panel orientation), and sensor readings. When commands change spacecraft state (e.g., adjusting attitude), the physics simulation reflects these changes in subsequent telemetry, creating a coherent feedback loop that withstands sustained attacker interaction.

Satellite Personality Configuration. Each mock mission is defined through a satellite personality file describing core spacecraft properties: surface emissivity, solar module count and placement, mass for thermal calculations, and all spacecraft-specific parameters. A separate ground configuration selects the protocol stack for telecommand/telemetry, ground station location, and communication parameters. This configuration-driven approach enables rapid deployment of new mock missions without code changes.

Ground Infrastructure Deception. The attacker-facing ground segment provides a remote desktop operator workstation within a network containing a mission control server and associated services common to real missions. The workstation displays mission control client interfaces that replicate the appearance of actual operator terminals. For the Chile deployment, the operator terminals were reproduced from the real mission's actual interface.

Radio Link Integration. The most novel technical contribution is the satellite-in-the-loop capability. Instead of only simulating the RF link, HoneySat can be connected to a secondary ground segment of a real mission with a real ground station and satellite. When an attacker sends a command through the honeypot, a corresponding command is sent to the actual satellite, and the real RF response is visible on the spectrum near the ground station. This defeats sophisticated attackers who might monitor the RF spectrum to verify that their interactions correspond to real satellite communications.

Points of Entry. Three lure mechanisms were tested: a web interface for existing mission control systems, a configuration page mimicking a satellite ground station appliance, and a fake internal mission website with documentation, upcoming pass schedules, and embedded remote desktop credentials. The internal website was populated by automated bot activity to generate realistic login traffic. The internal website significantly outperformed the other two approaches.

Demo / Proof of Concept

▶ Watch: 90% of operators cannot distinguish HoneySat from a real mission (10:00)

The deployment included five HoneySat instances operated over an extended period. The most technically sophisticated observed attack chain involved an attacker who: (1) mapped the ground segment network to identify available systems, (2) attempted to exfiltrate previously downlinked telemetry data, (3) probed whether the spacecraft was currently accessible during a ground station pass, and (4) attempted to modify onboard procedures. This sequence maps directly to real-world attack patterns documented in the MITRE Space ATT&CK framework.

The satellite-in-the-loop demonstration showed a waterfall spectrogram of telecommand/telemetry interactions performed through the honeypot framework and transmitted via a real satellite, confirming that the RF-level deception is functional. The framework is no longer actively deployed in its research configuration but is reported to be in use with industry partners.

Defensive Implications

▶ Watch: Satellite-in-the-loop: real RF transmissions synchronized with honeypot (14:00)

• Satellite ground infrastructure is being actively probed: The honeypot attracted meaningful attacker interactions including attempts at command modification, validating the threat model
• Network attacks dominate over RF attacks: Both historical incidents and honeypot observations confirm that attackers target ground segment networks rather than satellite RF links, aligning defensive priorities with network security rather than spectrum protection
• Deception is viable for space security: High operator confidence in the honeypot's realism (90%) validates that space mission deception is technically achievable and can sustain extended attacker engagement
• Configuration-driven deployment enables rapid response: New honeypot missions can be stood up quickly through configuration files, enabling defenders to deploy decoys matching specific threatened missions
• Space ATT&CK coverage is broad: Supporting 33 of 38 techniques means HoneySat can detect and characterize the vast majority of known space-targeted attack patterns
• Industry adoption is occurring: The framework is reportedly in use with industry partners, indicating practical viability beyond academic research
• Internal websites are effective lures: Fake internal documentation with embedded credentials outperformed technical interfaces, suggesting that attackers targeting space missions follow reconnaissance patterns similar to other domains

Key Takeaways

• HoneySat creates believable satellite mission honeypots that 90% of operators cannot distinguish from real missions
• The framework covers 33 of 38 MITRE Space ATT&CK techniques through a combination of real mission control software and simulated spacecraft
• Observed attacker behavior included component discovery, telemetry exfiltration, and attempted command modification -- validating the real-world threat
• Configuration-driven design enables rapid deployment of new mock missions without code changes
• Satellite-in-the-loop capability synchronizes honeypot interactions with real RF transmissions to defeat spectrum-monitoring adversaries
• The framework is transitioning from research to industry use, indicating practical deployment viability

About the Speaker(s)

The talk was presented by a researcher from CISPA Helmholtz Center for Information Security with shared co-first-authorship with Efren Lopez-Morales who was in the audience. The research involved collaboration with satellite mission operators, including access to real operator interfaces and a real satellite for the satellite-in-the-loop demonstration. The presenter engaged with questions from MIT Lincoln Laboratory, defense ministry representatives, and space security practitioners, demonstrating strong domain expertise in both cybersecurity and space operations.