Rising concerns over hackers using satellites to target US
Rising concerns over hackers using satellites to target
US
By OLIVIA BEAVERS - 06/26/18 06:00 AM EDT
The rapidly expanding number of satellites transmitting
GPS locations, cellphone signals and other sensitive information is creating
new opportunities for hackers.
It's a risk exacerbated by the growing number of aging
satellite systems in circulation. While it is cheaper to leave old satellites
in orbit rather than pulling them from space, the outdated systems are even
easier targets for hacking.
Just last week, security researchers at Symantec warned
that a China-based cyber espionage group known as Thrip targeted satellite,
telecom and defense companies in the United States and Southeast Asia.
"Thrip’s attack on telecoms and satellite operators
exposes the possibility that the attackers could intercept or even alter
communications traffic from enterprises and consumers," Symantec said in a
statement, noting its malicious behavior was well-hidden behind legitimate
information technology administration tools.
Thrip used malware to infect computers linked to the
satellites in an attempt to seize control of them — efforts that suggest the
group’s motivations could extend beyond spying and include “disruption,”
according to Symantec.
The satellite concerns has further inflamed fears about
China’s efforts to spy on the U.S. and to steal U.S. intellectual property.
The head of the House Homeland Security Committee
connected the report on Thrip to Beijing's efforts to steal intellectual
property.
“Our satellites are more advanced so they are stealing
our intellectual property — it is espionage to make their satellites on par
with ours,” Rep. Michael McCaul (R-Texas) told The Hill in an interview.
“Both commercial and military — it is a huge threat.”
Other lawmakers said it is a wake-up call that highlights
how critical infrastructure must be protected from outside threats.
“[I]t's no surprise that bad actors, like China,
continuously attempt to exploit vulnerabilities across our critical
infrastructure,” Rep. John Ratcliffe (R-Texas), chairman of the Homeland
Security Subcommittee on Cybersecurity and Infrastructure Protection, told The
Hill in a statement.
“The Symantec report helps clarify the scope of these
threats,” Ratcliffe continued, noting that the federal government and private
sector must be “capable of securing our most sensitive technologies, including
our satellite and telecommunications operations.”
While hackers have long targeted telecommunications for
espionage, experts say cyber officials may not have initially had their eye
towards the sky for such threats.
“This is a new twist on an old problem,” said Michael
Daniel, former special assistant to the president and cyber security coordinator
for the Obama administration.
Daniel told The Hill that the U.S. didn’t initially think
of cyberspace as a threat vector at the time satellites began popping into
space, but now the federal government must learn how to “adapt” to this
expanding environment.
“Unlike a lot of other environments, there is not more
land on a daily basis, but on a daily basis there is more cyberspace. So we are
making the problem harder because there is literally more territory to defend,
if you will, on a daily basis,” he noted.
And when threat actors gain access to satellites, they
can continue to gather information on their victims by tracking the traffic
that comes through the satellites over time — which they could exploit later
on.
“If they can siphon of real activity data ... they are
going to aggregate a lot of information how our operations are running, what we
are requesting, what we are looking at, what are concerns are, so out of that
you can get a really good picture,” said Jan Kallberg, a research scientist at
the West Point’s Army Cyber Institute.
“If you listen to logistic requests for a long time, you
would be able to know what the weaknesses are or what is problematic for us,”
Kallberg added.
There is also concern that China and other foreign
nations could wiggle into satellite systems now and remain embedded so that
they are prepared to commandeer the systems in a time of war.
Daniel said the ability to cause disruption with
satellites would be a desirable capability. If a country could leverage such
infrastructure, he said, they would reserve it for a time of war or intense
conflict because then the victim will have a better chance of determining who
is behind the attack and then responding.
While cyber experts and officials say they have not
observed satellites being used for digital warfare, it is not out of the realm
of possibility particularly because Russia and other nation states have shown
they are willing to use cyber weapons in times of conflict.
“We’ve seen Russia do this with Estonia and Ukraine, they
are just throwing everything they get at Ukraine,” McCaul said.
“We haven't seen as much of the cyber warfare [with
China], not to say they don’t have that capability. We just haven’t seen them
use it as much as say the Russians have,” the chairman added.
Russia-linked hacking groups have also previously been
tied to satellite hacking campaigns.
Kaspersky Lab, a Moscow-based cybersecurity firm, warned
in a 2015 blog post that a sophisticated “Russian-speaking” hacking group known
as Turla APT had intercepted the flow of downstream traffic coming from a
satellite to an unencrypted PC.
The firm, which described the group as “one the most
advanced threat actors in the world,” said it has exhibited an “exquisite satellite-based
command-and-control mechanism” that it can use as a base for launching
cyberattacks.
The concerns about satellite-focused hackers comes just
months after the Federal Communications Commission granted Tesla Founder Elon
Musk’s space program, SpaceX, the right to “construct, deploy, and operate” a
satellite system comprising of roughly 4,400 satellites.
These satellites will be joining the satellites already
up in space, which may already be decades old.
“If they are still functioning and they make money ...
you leave it up there,” Kallberg said. “That is a huge vulnerability because
they would be based off of technology that was maybe 10 to 15 years old.”
Comments
Post a Comment