Risk
10/28/2011
01:23 PM
50%
50%

Chinese Military Blamed For Hacking U.S. Satellites

Congressional investigators say two Earth observation satellites were hacked four times in recent years and it appears the Chinese military is responsible.

NASA, Microsoft Reveal Mars In Pictures
(click image for larger view)
Slideshow: NASA, Microsoft Reveal Mars In Pictures
China's military was likely responsible for hacking two U.S. satellites on four separate occasions several years ago, activity that could pose major threats to these types of operations if more serious intrusions occur, according to a Congressional report.

Two satellites--one controlled by NASA and the other by the space agency and the U.S. Geological Survey--experienced interference several times between October 2007 and October 2008, according to a draft report by the the U.S.-China Economic and Security Review Commission. The report is scheduled to be available publicly next month.

Specifically, Landsat-7--an Earth observation satellite managed by both parties--experienced 12 or more minutes of interference on Oct. 20, 2007. The incident was only discovered when the same satellite had a similar disruption again on July 23, 2008, according to the draft report.

Terra EOS, another Earth observation satellite managed solely by NASA, experienced two or more minutes of interference on June 20,2008, and then nine or more minutes of interference again on Oct. 22, 2008.

Hackers gained access to the satellites through Svalbard Satellite Station, a ground control station in Spitsbergen, Norway.

While these incidents did not cause any major harm or damage, this type of intrusion could pose a major threat to a satellite with "more sensitive functions," according to the draft report.

"For example, access to a satellite's controls could allow an attacker to damage or destroy the satellite," according to the report. "The attacker could also deny or degrade as well as forge or otherwise manipulate the satellite's transmission."

If a hacker gained a "high level of access," it also could access information or imagery from the satellite's sensors, or manipulate other terrestrial or space-based networks used by the satellite, according to the report.

A spokesperson said the commission's draft report could be modified before the final report is made available.

The incidents mentioned in the report are not the first time the commission has brought to light China's hacking of U.S. government operations. A report by the commission released in November revealed an incident on April 8, 2010, when China Telecom diverted U.S. and other foreign Internet traffic through servers in China.

U.S. government activity affected in that incident included traffic going to and from U.S. .gov and .mil sites, including sites for the Senate, the four main armed services branches, the office of the Secretary of Defense, NASA, the Department of Commerce and the National Oceanic and Atmospheric Administration.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
10/31/2011 | 3:45:21 PM
re: Chinese Military Blamed For Hacking U.S. Satellites
These types of incidents make me think about the definition of cyber-war. Assuming that this attack could be irrefutably proven to have originated from the Chinese military (highly unlikely for obvious reasons), at what point do hacks become sabotage, and attempts at sabotage become cyber-war?
Brian Prince, InformationWeek contributor
KNINJA000
50%
50%
KNINJA000,
User Rank: Apprentice
10/28/2011 | 8:26:55 PM
re: Chinese Military Blamed For Hacking U.S. Satellites
So what's the problem? This type of attack isnt even dangerous, it's those meddling kids defacing corporate websites that we really need to thunderwack. At least that's how our leaders see it.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.