Evaluating an Effective Ransomware Infection Vector in Low Earth Orbit Satellites
Marin Donchev, Dylan Smyth
TL;DR
This work addresses the risk of in-orbit ransomware by presenting an end-to-end infection path for a NASA Core Flight System (cFS) based satellite without relying on supply-chain compromises. It constructs an emulated testbed, introduces a vulnerable custom application, and delivers a novel, shellcode-based ransomware that takes control of the satellite radio, communicating the infection to the ground station and awaiting a decryption key to restore operation. Through 300 trials, the authors observe a 33.3% exploitation success rate, with the remainder causing unintended DoS due to shellcode failures, underscoring reliability challenges. The study highlights practical defense considerations, notably encryption of inter-system communications, and outlines future work to generalize the attack and reduce reliance on Python, contributing a concrete, risk-focused perspective on satellite software security in NTNs.
Abstract
Non-Terrestrial Networks (NTNs) and satellite systems have become an important component of modern data communication systems in recent years. Despite their importance, the security of these systems is often limited, leaving them vulnerable to determined attackers. In this paper, we outline a scenario in which an attacker can infect an in-orbit NASA Core Flight System (cFS) based satellite with ransomware and communicate the infection back to a satellite operator. This paper is the first to demonstrate an end-to-end exploit path that results in a ransomware infection without the need for a supply chain attack or compromised credentials. Novel ransomware is delivered to an emulated satellite system using custom shellcode that exploits a weakness in the considered scenario. The scenario considered by this initial piece of work achieves a success rate of 33.3\% for a complete successful infection.