Assessing the Feasibility and Impact of Cyberattacks in the Satellite Environment

Details

Supervisors

Pelsser Cristel

Faculty

Ecole polytechnique de Louvain

Degree label

Master [120] en sciences informatiques, à finalité spécialisée

Abstract

enModern satellite systems combine COTS hardware with connected ground infrastructures and orbital platforms that cannot be physically accessed once they are launched. Unfortunately, no existing public risk framework takes this detail into account. Terrestrial methodologies score IT vulnerabilities precisely but cannot represent the permanent loss of a spacecraft. Space-specific catalogues exist but they list threats without evaluating their feasibility. This thesis proposes a four-step risk assessment methodology that combines both perspectives. Feasibility is decomposed into four parameters adapted from the Common Criteria attack-potential model: expertise, knowledge of target, window of opportunity and equipment. Impact is computed through a weighted sum based on the HEAVENS automotive framework. Four documented incidents serve as calibration cases: the 2022 Viasat KA-SAT wiper attack, NASA’s Terra EOS unauthorised commanding in 2008, the South Korean GPS jamming campaigns, the Turla group’s covert command-and-control channel over DVB-S satellite downlinks. In each case the computed risk levels reproduce the documented severity. The framework is then applied to OreSat, a university CubeSat whose hardware, software and frequency plans are fully open-source, across six threats that span the ground, link and space segments. Iridium first-generation pager interception enters the analysis separately because it is a purely passive confidentiality threat. Against the spacecraft itself, the results point away from RF exploits. The conventional IT vectors dominate instead: the internet-facing ground station scores High and the unauthenticated CAN bus scores Critical. UHF jamming and L-band spoofing, by contrast, do not exceed Medium. Perturbation tests on single feasibility parameters leave three of the four calibration results unchanged. Limitations are stated plainly: the sensitivity of the weight scheme, the assumption that threats can be scored independently of one another and the missing impact dimension for intelligence loss in military contexts. Taken together, these results identify the unauthenticated CAN bus and the internet-facing ground station as the critical exposures of the spacecraft and its command chain, rather than the radio-frequency vectors that the threat literature most often emphasises.