Researchers find API flaws let multiple satellites be commanded

Alissa Knight told CyberSat conference attendees last week that application programming interfaces act as a critical weak point in space systems because they carry software vulnerabilities.

As chief executive of Assail, a cybersecurity firm testing enterprise system security with agentic AI swarms, Knight said application programming interfaces act as software intermediaries that let different programs communicate and users authenticate across systems. APIs are a keystone of new space because they let satellite operators remotely control vehicles through cloud-based, API-powered dashboards.

She said operators do a good job authenticating users but a terrible job authorizing them, and estimated that Broken Object Level Authorization accounts for about 98 percent of the API vulnerabilities she finds. BOLA is an authorization attack that persists even when authentication is strong.

After logging in, the dashboard issued a bearer token scoped for one satellite, yet because of BOLA that same token let Knight direct any satellite in the constellation as her AI swarm took command.

"We do a really good job at authenticating, and a really terrible job at authorization," Knight said

Alissa Knight, Via Satellite

She said agentic coding creates vulnerable enterprise software, shipping cycles squeezed from months down to 12 or 24 hours, and security left out of the writing phase. These factors explain why authorization vulnerabilities recur repeatedly in APIs.

In August, researchers Andrzej Olchawa and Milenko Starcik of VisionSpace uncovered flaws in open-source satellite control software that could have allowed satellite hijacking, and the flaws have since been patched. The researchers revealed the flaws at Black Hat USA and DEF CON in Las Vegas after testing NASA‘s core Flight System and the Yamcs mission control system.

NASA’s core Flight System runs on onboard computers across missions including the $10 billion James Webb Space Telescope and Intuitive Machine’s Odysseus lunar lander, which touched down on the moon in February. Yamcs was developed by European company Space Applications Services and is used by ground controllers to command satellites.

We found 37 separate vulnerabilities.

Milenko Starcik, IEEE Spectrum

Olchawa and Starcik described the flaws as trivial, low-hanging fruit, and easy to exploit for anyone able to read the open-source code. They found 37 separate vulnerabilities within an hour or two of reviewing the code and demonstrated sending a command to a spacecraft to fire a thruster and change its orbit. The flaws have since been patched, but the researchers warn that space-system cybersecurity has long been overlooked and that closed-source systems may be equally easy to breach.

He was surprised to find such low-hanging fruit in systems from NASA or companies collaborating with major space agencies, Olchawa said. Starcik said operators are moving away from private networks and closed systems toward cloud services, VPN connections, and remote operation from home.

As a result, spacecraft control tools now run as web-based interfaces, which are harder to shield. Once inside, even without full permissions, an attacker can bypass authentication, seize control, issue commands, delete files, and send orders to spacecraft.

To exploit NASA’s core Flight System, an attacker needs ground-station access because spacecraft-control frequencies are unprotected, which state-funded hackers in Russia, China, or North Korea could achieve. Yamcs can be exploited from anywhere using phishing, malicious configuration files, or cross-site scripting flaws.

Olchawa said security usually ranks last among mission requirements, though requests for penetration testing are rising and the field remains early in its development. He has seen insecure systems in the European space industry but cannot publish details about them.

Barbara Grofe, a space asset security architect at Spartan Corp, said at RSAC Conference 2025 that satellites are dangerously exposed and not even military-grade orbital technology is immune.

"You can build your own equipment for $10 and interfere with $110 million satellites," Grofe said

Barbara Grofe, UNDERCODE NEWS

She said an attacker can assemble gear costing $10 and disrupt a satellite worth $110 million, and public code on GitHub can be turned into a weapon against satellite networks. She noted that satellites underpin communications, navigation, defense, and finance, while basic hardware and GitHub access could theoretically allow anyone to disrupt systems worth millions of dollars.

Grofe said nation-state resources are no longer necessary for space hacking and that inexpensive software-defined radio kits put amateur attacks within reach. Space lacks a solid international cybersecurity framework, and while UN accords exist they lack enforcement, leaving cyber activities in orbit in legal gray zones.

She pointed to limited telemetry and unstructured governance as causes of attribution difficulty, and said one breach could put global data, navigation, and communications at risk. The Strategist identifies hacking as the most pressing danger to space systems, ahead of anti-satellite weaponry.

Such operations can quietly damage performance, take data, or endanger capabilities without firing a shot, and deniability is plausible. In October 2025, scientists from the University of California San Diego and the University of Maryland caught large amounts of private and potentially sensitive government and military messages as they scanned internet traffic to listen in on geostationary satellites.

The team had expected to discover flaws but instead encountered exposed sensitive communications while scanning internet traffic. In August 2025, German researchers at Black Hat in Las Vegas showed that NASA and Airbus software and encryption libraries could be exploited to power down, reposition, or crash satellite flight software.

OpenC3 Cosmos, an open-source app, also permitted remote code execution and cross-site scripting attacks against ground stations. A Russian hacker broke into servers controlling the German-British-American RoSAT X-ray observatory in late 1997, and in 1998 its imager pointed at the sun and damaged the satellite beyond repair.

The article uses the case to show that a hack can make a satellite useless without any kinetic attack. Structural exposure factors include legacy hardware that has remained in service for decades past normal patch cycles, limited ability to update software on orbit, and ground segments constrained by uptime requirements and vendor dependencies.

Space systems also face security-performance trade-offs because of limited onboard computing power, memory, bandwidth, intermittent connectivity, and harsh-environment reliability demands. Satellites are designed for longevity, not rapid refresh; components are chosen years before launch, and updates require a technician with physical access, which makes updates operationally risky and sometimes technically constrained.

Attackers move fast, while defenders must manage long hardware lifecycles and bespoke architectures with fewer mature security tools. Australia is poorly prepared for space cyber threats because threat-information sharing is shallow, redundancy is thin, there are skills shortages in space cybersecurity personnel, and supply-chain vulnerabilities require ongoing visibility.

An October 2025 report from RMIT’s Centre for Cyber Security Research and Innovation, sponsored by Australia’s Department of Defence, detailed these limitations. The Strategist urges operators to treat space as critical infrastructure and build resilience through encrypted links, secure-by-design code, segmented ground networks, tightened identity and access measures along command paths, and tested recovery procedures. The piece also recommends investment in space-cyber career pathways via universities, technical education, cadetships, and industry placements.

By the end of 2022, 6,718 satellites were active after a rise of nearly 2,000 in a single year, and about 10,206 objects are believed to be in space, most of them satellites.

BBC Science Focus notes that navigation, military surveillance, and banking depend on these space-based systems, which makes them desirable targets. The US Air Force’s Hack a Sat event in 2023 allowed three teams to break into a satellite, and the 2023 event demonstrated satellite control within 90 minutes. The article states no satellite has ever been hacked and the likelihood remains slim, though damages could be severe.

Satellite hacking spans ground infrastructure, orbital assets, and communication networks as a system-level challenge, according to the site. Ground stations are the weakest link. They often run legacy systems and weak endpoint defenses, and they rely on unsecured credential databases, VPN misconfigurations, and unpatched software.

Attackers use these weaknesses to implant backdoors, take over privileged accounts, intercept command signals, or inject malicious commands. Intersatellite links can enable on-orbit lateral movement, so one compromised node can spread malware throughout a constellation when automated systems replicate malicious commands.

The network effect based on constellations amplifies risk beyond one satellite. Satellites often run decades-old technology with lifespans over 20 years, no security updates, proprietary protocols older than modern standards, and embedded systems that cannot receive remote updates.

Preventive measures include zero-trust architecture, hardware security modules, quantum-resistant encryption, secure boot, redundant command validation, and supply-chain security. Detection combines behavioral analysis, physics-informed neural networks, and pattern recognition, while response requires automated incident response and command isolation protocols.

Attacks on satellite command and control can disrupt operations, redirect satellites, or turn American assets into weapons against their owners. New Space Economy says strong cybersecurity is essential from satellite design through ground control stations, together with zero-trust models and segmentation.

Cyberattacks on ground stations and data centers can sever information and control, making space assets useless. The article also identifies physical sabotage, supply-chain disruptions, insider threats, and social engineering as additional vulnerabilities.

No globally recognized cybersecurity law for space exists, the 1967 Outer Space Treaty lacks legal binding force, and not every country has signed it. Anuradha Damale-Day of Satellite Applications Catapult says regulation will expand as more satellites operate and interests move toward outer space.

Knight describes herself as a recovering hacker and was brought into the U.S. Intelligence Community after an arrest.