Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Chinese Military Blamed For Hacking U.S. Satellites

Congressional investigators say two Earth observation satellites were hacked four times in recent years and it appears the Chinese military is responsible.

NASA, Microsoft Reveal Mars In Pictures
(click image for larger view)
Slideshow: NASA, Microsoft Reveal Mars In Pictures
China's military was likely responsible for hacking two U.S. satellites on four separate occasions several years ago, activity that could pose major threats to these types of operations if more serious intrusions occur, according to a Congressional report.

Two satellites--one controlled by NASA and the other by the space agency and the U.S. Geological Survey--experienced interference several times between October 2007 and October 2008, according to a draft report by the the U.S.-China Economic and Security Review Commission. The report is scheduled to be available publicly next month.

Specifically, Landsat-7--an Earth observation satellite managed by both parties--experienced 12 or more minutes of interference on Oct. 20, 2007. The incident was only discovered when the same satellite had a similar disruption again on July 23, 2008, according to the draft report.

Terra EOS, another Earth observation satellite managed solely by NASA, experienced two or more minutes of interference on June 20,2008, and then nine or more minutes of interference again on Oct. 22, 2008.

Hackers gained access to the satellites through Svalbard Satellite Station, a ground control station in Spitsbergen, Norway.

While these incidents did not cause any major harm or damage, this type of intrusion could pose a major threat to a satellite with "more sensitive functions," according to the draft report.

"For example, access to a satellite's controls could allow an attacker to damage or destroy the satellite," according to the report. "The attacker could also deny or degrade as well as forge or otherwise manipulate the satellite's transmission."

If a hacker gained a "high level of access," it also could access information or imagery from the satellite's sensors, or manipulate other terrestrial or space-based networks used by the satellite, according to the report.

A spokesperson said the commission's draft report could be modified before the final report is made available.

The incidents mentioned in the report are not the first time the commission has brought to light China's hacking of U.S. government operations. A report by the commission released in November revealed an incident on April 8, 2010, when China Telecom diverted U.S. and other foreign Internet traffic through servers in China.

U.S. government activity affected in that incident included traffic going to and from U.S. .gov and .mil sites, including sites for the Senate, the four main armed services branches, the office of the Secretary of Defense, NASA, the Department of Commerce and the National Oceanic and Atmospheric Administration.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
10/31/2011 | 3:45:21 PM
re: Chinese Military Blamed For Hacking U.S. Satellites
These types of incidents make me think about the definition of cyber-war. Assuming that this attack could be irrefutably proven to have originated from the Chinese military (highly unlikely for obvious reasons), at what point do hacks become sabotage, and attempts at sabotage become cyber-war?
Brian Prince, InformationWeek contributor
KNINJA000
50%
50%
KNINJA000,
User Rank: Apprentice
10/28/2011 | 8:26:55 PM
re: Chinese Military Blamed For Hacking U.S. Satellites
So what's the problem? This type of attack isnt even dangerous, it's those meddling kids defacing corporate websites that we really need to thunderwack. At least that's how our leaders see it.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.