Guarding the Galaxy: Satellite Ransomware and Countermeasures

Ransomware attacks are one of the most prominent and disruptive cyber threats to terrestrial systems. The primary purpose of ransomware is to hold systems or data hostage, often through encrypting files, and demand payment to decode the data. To date, publicly disclosed threats against the ground segment of space systems have been acknowledged; however, threats against the space vehicle have largely been theorized but rarely seen in the wild. Understanding the potential threats may help researchers develop countermeasures to mitigate potential attack vectors. This paper identifies the requirements and presents a proof-of-concept ransomware on a notional space vehicle using NASA’s core Flight System. An evaluation of the attack surface is presented, which characterizes the ransomware-based vulnerabilities. We conclude with a series of recommended remediations in order to decrease the space vehicle’s attack surface against ransomware while acknowledging the potential negative impact to performance and cost.