Black Hat USA 2025 | Burning, Trashing, Spacecraft Crashing

Why It Matters

Cyber‑level attacks on satellites now pose a realistic, non‑kinetic threat to critical communications and intelligence, forcing operators to prioritize zero‑trust security across the entire space ecosystem.

Key Takeaways

• Commercial satellite constellations dramatically increase space attack surface.
• Legacy mission‑control software lacks zero‑trust, exposing critical vulnerabilities.
• XSS exploits in YAMCs and OpenC3 can hijack spacecraft commands.
• CFS memory‑management flaw enables remote code execution on orbiting hardware.
• Cyber attacks now rival kinetic anti‑satellite weapons in effectiveness.

Summary

The Black Hat USA 2025 session, led by Mileno Star and Andre of Vision Space, highlighted the growing cyber‑risk landscape for space systems. With commercial constellations such as Starlink and OneWeb proliferating alongside renewed military satellite launches, the orbital environment now presents a massive, high‑value attack surface that was largely absent during the Cold War era.

The presenters traced the evolution of research from early hobbyist satellite hacks to the 2022 Viasat incident, emphasizing that legacy mission‑control software—YAMCs, NASA’s Open MCT, OpenC3, and the Core Flight System (CFS)—was never built with zero‑trust principles. Demonstrations showed how simple cross‑site scripting (XSS) flaws in YAMCs and OpenC3 can let an adversary inject JavaScript, issue unauthorized telecommands, and even seize full control of a ground station interface.

A more sophisticated exploit targeted the CFS memory‑management module, manipulating the global offset table to redirect function calls and obtain a reverse shell directly from an onboard Linux system. The demo simulated a spacecraft’s orbit being altered and a remote code execution payload returning to the attacker, mirroring the kind of cyber‑physical sabotage previously achievable only with kinetic anti‑satellite missiles.

These findings underscore an urgent need for industry‑wide security hardening: adopting zero‑trust networking, rigorous code audits, and secure software supply chains for both ground and flight segments. Failure to address these vulnerabilities could enable nation‑states or criminal groups to disrupt communications, espionage, or even de‑orbit critical assets, reshaping the strategic calculus of space operations.

Original Description

Burning, Trashing, Spacecraft Crashing: A Collection of Vulnerabilities That Will End Your Space Mission

The frequency of space missions has been increasing in recent years, raising concerns about security breaches and satellite cyber threats. Each space mission relies on highly specialized hardware and software components that communicate through dedicated protocols and standards developed for mission-specific purposes. Numerous potential failure points exist across both the space and ground segments, any of which could compromise mission integrity. Given the critical role that space-based infrastructure plays in modern society, every component involved in space missions should be recognized as part of critical infrastructure and afforded the highest level of security consideration.

This Briefing highlights a subset of vulnerabilities that we identified within the last couple of years across both ground-based systems and onboard spacecraft software. We will provide an in-depth analysis of our findings, demonstrating the impact of these vulnerabilities by showing our PoC exploits in action—including their potential to grant unauthorized control over targeted spacecraft. Additionally, we will show demonstrations of the exploitation process, illustrating the real-world implications of these security flaws.

By:

Andrzej Olchawa | Offensive Security Researcher, VisionSpace Technologies GmbH

Milenko Starcik | Head of Cyber Security, VisionSpace Technologies GmbH

Ricardo Fradique | Cybersecurity Engineer, VisionSpace Technologies GmbH

Ayman Boulaich | Cybersecurity Intern, VisionSpace Technologies GmbH

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#burning-trashing-spacecraft-crashing-a-collection-of-vulnerabilities-that-will-end-your-space-mission-45005