Space cybersecurity starts on the ground.

Milenko Starcik: Understanding how a space mission works is something that is quite important, and to understand that a breach in one system might have a different impact on the actual mission than a breach in another system. Like, if a web server is breached and there is some malicious files hosted on that server for example, that might have for the actual satellite no effect at all. But if you manage to break into the mission control system and get control over that, you can suddenly send commands to the actual spacecraft without requiring a ground station on your own.

Maria Varmazis: Welcome. I'm Maria Varmazis and you're listening to "T-Minus: Space-Cyber Briefing". In this show, we examine the evolution of cybersecurity, and the global and orbital infrastructure that powers, protects, and connects our lives. Hi, everyone. Thanks for joining me today. Sometimes it happens in the world of podcasting where you have an interview that is so jam-packed with good stuff that you need to share it with the world in two separate parts, Part 1 this week and Part 2 next week. And that is what happened when I chatted with two people who are foundational to the global space cybersecurity community. And they would be Milenko Starcik and Andrzej, or Andy, Olchawa of VisionSpace. These two have been very busy the past few years, going from InfoSec con to con, presenting on or teaching space cybersecurity as they go. And they have also written a book coming out soon from No Starch Press called "The Spacecraft Hacker's Handbook", which they will tell you more about when we get started. Now, we cover a lot of ground on space cybersecurity in this and next week's episodes. And the goal here is to point InfoSec professionals in the right direction on the fundamentals of space cybersecurity. So, without further ado, let's get started. Gentlemen, thank you both so much for joining me, especially after what sounds like an extraordinarily busy, but worthwhile DEFCON. Welcome back. I hope you've recovered from con crud. I hope you're feeling better.

Andrzej Olchawa: Almost, almost.

Milenko Starcik: Thank you. Thank you very much.

Maria Varmazis: Well, why don't we start with an introduction? So, since I'm speaking to two of you, our audience can get to know whose voice is whose. So Milenko, why don't I start with you?

Milenko Starcik: Sure, yeah, I'm Milenko Starcik. I'm currently leading the cyber security team at VisionSpace in Germany. My background is mostly in actually telecommunications, but then moved quickly to focus on cybersecurity. Been in the space industry now since roughly eight years. Interested in that for much longer than that, almost my entire life basically. So, yeah, that's it for me.

Maria Varmazis: Wonderful. Andrzej, over to you.

Andrzej Olchawa: Yeah, my name is Andrzej Olchawa. I go by Andy. It's easier for everyone. I've been in cybersecurity sector since around three to four years, when I crossed from software engineering to offensive security. And that's what I'm mainly focusing on right now. So it's like offensive security activities for space systems and space customers. My background is software engineering. And I worked, I spent around 15 years, prior to my transition to offensive security, working for, in the space industry, maintaining and developing mission control systems and ground segment applications in general.

Maria Varmazis: Gentlemen, thank you both so much for those great intros and for joining me today. I don't normally say this part, but I know you have a book that is coming out and this book is so important to our audience. Normally I would say leave it to the end, but I actually want to make sure we get to this first.

Milenko Starcik: So yeah, we have "The Spacecraft Hacker's Handbook" coming out with No Starch Press. We are very excited. It has been almost two very busy years writing. I think the idea was born, like, December almost two years ago and we've been working on it since. Now, recently we've been to DEFCON and actually got first time physical copy with a DEFCON edition of the book. And now the official release is I think 3rd of November. So, yeah, it's been very exciting and it gives a very nice introduction to space security. So, we go from zero for cybersecurity professionals who want to get into space cybersecurity, but also for space professionals to get more into cybersecurity. So, starting from the actual how a space mission works, what the risks are that are specific for space, and then very quickly into actually hands-on testing ground segment applications, onboard software, and also going to satellite terminals and GNSS systems.

Maria Varmazis: That is amazing. I, as I mentioned earlier, I genuinely cannot wait to get my hands on this book, and I imagine every single person listening to this podcast will want to do the same. So, thank you for telling me about this. And I'm very excited to read it. And I figured, Milenko, why don't we start with you? I imagine when the two of you were thinking about putting this book together, there were I'm sure a number of maybe what we might call canon events in space cybersecurity that had occurred. The one that I often think of is, you know, Viasat 2022, but I'm sure that is not the only one. This is a question I get a lot from people who are interested in space cyber, and I'm sure you do too, about what are those sort of canon events that people need to know about and study and understand? Can you give me maybe a bit of a lay of the land there?

Milenko Starcik: There have in the past been quite a number of events. I think it's currently, it's accelerating and there is many small events. It's, I think not just about the big bang events like the Viasat incident, which was very popular and drove a lot of the developments that are currently happening. But it's often the smaller events I think that show where the actual weaknesses currently are. So, there have been, for example, these hack-and-leak incidents with the European Space Agency where, like, hundreds of gigabytes of sensitive, sometimes sensitive data have been exfiltrated and put on the darknet for sale. And I think this shows very well the big weakness is often not actually on the satellite, but it's on the ground and it's sometimes not even specialized infrastructure. It can be just something ordinary that you would find in any other tech company, for example, like a software repository.

Maria Varmazis: This is a really interesting point that you bring up right here about how many of the threats in space cybersecurity are not necessarily hyper-specialized to space. And I wonder about the perception versus reality there where I know, at least to me, it seems from the space industry, there's a lot of it seems almost mythology about the skillset needed to be a space cyber professional versus what the two of you I think bring is a good reality check on what actually is needed for a, you know, an InfoSec professional to understand at least at a basic level how space cybersecurity works.

Andrzej Olchawa: I think the most important thing is to understand that the actual space attack surface is very narrow and is very small. Even if we are talking about constellations, all those spacecraft are always the same. There might be thousands of spacecraft flying in the constellation, but they are pretty much the same, and they present like one attack surface, like one node in the whole system. And most of the system actually is present in the ground segment. So, and that is a compilation of many, many different technologies, many different infrastructure, hardware and software. Which often is not something related to space, but they make up the whole system, or most of the systems, system in space sector. And what's also important to realize is that it's not just one technology but many different technologies. And in terms of security, what is required is a skillset of pretty much anything and everything you can think of in terms of cybersecurity. Because the nodes in the systems we are trying to protect is, are anything from, you know, from the hardware components to web applications or cloud infrastructure, in many different technology stack, many different hardware devices, many different operational aspects, which also come into that. So, thus, on one hand, it's very interesting because if you get into space cybersecurity, you're going to get to play with any technology you can think of. On the other hand, it's also quite challenging because there are more people who know everything, so often the teams are composed of many different skillset experts. And all that is wrapped around the knowledge of space operations and space technology in general.

Maria Varmazis: We'll take a quick break now. See you in a few. [ Music ] Welcome back. Let's return now to my conversation with Milenko Starcik and Andy Olchawa from VisionSpace. Here's Milenko now on what an InfoSec professional needs to understand to upskill in space cybersecurity.

Milenko Starcik: Understanding how a space mission works is something that is quite important, and to understand that not all the systems are, have, can, like, a breach in one system might have a different impact on the actual mission than a breach in another system. Like, if a web server is breached and there is some malicious files hosted on that server, for example, that might have for the actual satellite no effect at all. That might have, like, a bad, get a, give a bad reception or something. But for the actual satellite, it's not harmful. But if you manage to, like, break into the mission control system and get control over that, you can suddenly send commands to the actual spacecraft without requiring a ground station on your own. Because that's also a question people ask is, like, do I need to know about radio? Do I need to know, do I need to have an antenna to do this kind of stuff? And, like, realistically, no. Of course you can do things with an antenna, some testing, but most of the attack surface is on the ground because also most of the users are on the ground. So, the human element is, like, in every cybersecurity system is usually the weakest link, and the spacecraft itself does not take any actions if you don't command it to. So, on the ground, info stealers, phishing is still the primary entrance into these kind of systems, no matter how well they are protected.

Maria Varmazis: Makes sense. And just in terms of pure numbers and volume there. Although I'm thinking also of, you know, how everybody wants to go, I hacked a satellite. It's not as sexy to go, I hacked a ground station.

Milenko Starcik: Yeah, that's true.

Maria Varmazis: It's true. I mean, there is an element of that, right? Like, it's the cool factor of, like, I want to hack a satellite. But at the same time, I mean, you've both mentioned ground stations so many times, and that makes so much sense that that is a major entry point. That's the point at which one must also deploy defenses. And I'm curious in terms of overlapping skillsets with, say, OT for example, is it almost a one-to-one skill set there? If someone's an OT professional, can they kind of seamlessly slot in space cyber in that case, or is it a very rarefied set of knowledge there?

Andrzej Olchawa: So I would say that OT Is a subset of what a space mission and cybersecurity for space mission would look like. Because if you are talking, for instance, if you are talking about ground station, there is a lot of, there might be a lot of devices which are responsible for controlling the actual satellite dish and other equipment. So that's like a typical OT ICS sector. But that just, that's just one element of space mission. Then we have, you know, we have a mission control system, which is usually standard cloud or on-premise infrastructure with a standard, with standard Windows or Linux operating systems, or both. Standard software development stacks, applications, and in, you know, in Java, in C++, in Python. So, just, that's what I said at the beginning. The skillset is pretty much everything you can think of.

Milenko Starcik: Yeah, I would say that it's less of a like one person knows everything. It's more like if you want to do the full chain, you need a team no matter what, because no one can be the super expert on embedded security, I don't know, fault injection, at the same time be an expert on cloud pen testing and Windows configuration auditing. Like, it's all of that. So, I think that's what makes it interesting. Of course it's not 100% overlap with OT. OT is more, like Andy said, a subset. Because, for example, when we look at the protocols, so we might have in a ground station of course just regular OT hardware. So there it's 100% overlap. But if we go to the satellite communication itself or onboard the satellite, the communication, there might be different systems used, different protocols, so there will be definitely some learning required to understand these new protocols.

Andrzej Olchawa: Even the communication between, even the communication, because all of the communication, space-related communication, is they follow usually the same set of standards. And even the communication between the ground station and mission control, even though it is on the ground, they also follow specific standards. So for instance, it doesn't, the communication doesn't go through HTTP, right? It goes through TCP, TCPIP, but they have specific protocols. So, you know, this might be something that one might need to learn, but it's just like anything else. In the end, it's going to be TCP and it's going to be some sort of protocol, and someone will have to learn it and then hack on it.

Maria Varmazis: And that's "T-Minus: Space-Cyber Briefing" brought to you by N2K CyberWire. Thanks for listening to today's episode. A reminder that this conversation with Milenko and Andy is not done. It continues in next week's episode, in fact. So next week, Part 2 of my space cybersecurity fundamentals chat with Milenko Starcik and Andrzej Olchawa of VisionSpace. Make sure to tune in. Now, if you liked what you heard today, you will also enjoy our newsletter, "Signals and Space". You'll get research and notes pulled together by our producer, Ethan Cook, and me, along with this week's top space cyber news stories. Make sure to subscribe by visiting thecyberwire.com/newsletters. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing cybersecurity landscape. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space@n2k.com. We're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K helps cybersecurity professionals grow, learn, and stay informed. As the nexus for discovery and connection, we bring you the people, the technology, and the ideas shaping the future of secure innovation. Learn how at N2K.com. Thank you for listening to "T-Minus". I am your host, Maria Varmazis. The show is produced by Ethan Cook and Liz Stokes. We are mixed by Elliott Peltzman and Tre Hester, with original music by Elliott Peltzman. Our executive producer is Jennifer Eiben, with content strategy by Ma'ayan Plaut. Peter Kilpe is our publisher. See you next week.