[论文解读] Silent Subversion: Sensor Spoofing Attacks via Supply Chain Implants in Satellite Systems

Jack Vanlyssel, Gruia-Catalin Roman+1 more|arXiv (Cornell University)|Mar 11, 2026

Space Satellite Systems and Control被引用 0

一句话总结

本论文展示了一种端到端的机载供应链植入，能够在卫星仿真器中生成符合模式的、节奏正确的伪造遥测，暴露了一个新的内部威胁向量，并为小型卫星提出对策。

ABSTRACT

Spoofing attacks are among the most destructive cyber threats to terrestrial systems, and they become even more dangerous in space, where satellites cannot be easily serviced, and operators depend on accurate telemetry to ensure mission success. When telemetry is compromised, entire spaceborne missions are placed at risk. Prior work on spoofing has largely focused on attacks from Earth, such as injecting falsified uplinks or overpowering downlinks with stronger radios. In contrast, onboard spoofing originating from within the satellite itself remains an underexplored and underanalyzed threat. This vector is particularly concerning given that modern satellites, especially small satellites, rely on modular architectures and globalized supply chains that reduce cost and accelerate development but also introduce hidden risks. This paper presents an end-to-end demonstration of an internal satellite spoofing attack delivered through a compromised vendor-supplied component implemented in NASA's NOS3 simulation environment. Our rogue Core Flight Software application passed integration and generated packets in the correct format and cadence that the COSMOS ground station accepted as legitimate. By undermining both onboard estimators and ground operator views, the attack directly threatens mission integrity and availability, as corrupted telemetry can bias navigation, conceal subsystem failures, and mislead operators into executing harmful maneuvers. These results expose component-level telemetry spoofing as an overlooked supply-chain vector distinct from jamming or external signal injection. We conclude by discussing practical countermeasures-including authenticated telemetry, component attestation, provenance tracking, and lightweight runtime monitoring-and highlight the trade-offs required to secure resource-constrained small satellites.

研究动机与目标

• 通过被篡改、供应商提供的卫星组件传递的传感器欺骗来动机及风险量化。
• 在卫星仿真器中展示端到端的机载遥测欺骗可行性。
• 说明伪造遥测如何通过标准地面系统验证并误导操作人员。
• 提出架构与运维层面的对策，以减轻小型卫星的供应链基础欺骗风险。

提出的方法

• 在 NASA NOS3 中实现 SOLO，一种恶意飞行软件辅助组件，配合核心飞行软件（cFS）。
• 使用相同的消息ID和数据结构复制目标遥测接口（星敏感星追踪器），以实现软件总线不可区分性。
• 在延迟后通过任务上下文触发开启欺骗，然后替换或偏置真实传感器数据。
• 以与正规设备相同的节奏发布伪造遥测分组，以规避地面工具的句法检测。
• 展示偏置与替换两种模式，COSMOS 验证格式和节拍，同时隐藏伪造数据的来源。

实验结果

研究问题

• RQ1 通过供应链引入的第三方机载组件，是否能够生成模式有效且与真实数据不可区分的伪造遥测？
• RQ2 哪些架构弱点使机载传感器欺骗能够绕过发射前验证和在轨监控？
• RQ3 在仿真环境中，伪造遥测如何影响地面操作人员的认知和任务完整性？
• RQ4 在资源受限的卫星中，哪些对策和架构变更对抗供应链传感器欺骗最有效？

主要发现

• 一个恶意的机载组件可以通过集成测试，发布格式正确、节拍正确的遥测，并被地面工具误认为是合法数据。
• 伪造遥测可用于偏置估计器或完全替换传感器数据流，而无可检测的格式或时序异常。
• 地面工具（COSMOS）验证语法但不验证语义完整性或来源真实性，从而实现隐蔽冒充。
• 对真实设备的内部抑制与伪造数据的替换可以在地面日志或遥测存档中没有可见指标地发生。
• 研究识别出架构上的薄弱环节，如不透明的供应链、对遥测的隐式信任、缺乏运行时监控以及可观测性不足，阻碍检测。