Theft, Technique CM0000

TECHNIQUES

SPARTA

Reconnaissance

Gather Spacecraft Design Information

Software

Firmware

Cryptographic Algorithms

Data Bus

Thermal Control System

Maneuver & Control

Payload

Power

Fault Management

Gather Spacecraft Descriptors

Identifiers

Organization

Operations

Gather Spacecraft Communications Information

Communications Equipment

Commanding Details

Gather Launch Information

Flight Termination

Eavesdropping

Uplink Intercept

Downlink Intercept

Proximity Operations

Gather FSW Development Information

Development Environment

Security Testing Tools

Monitor for Safe-Mode Indicators

Gather Supply Chain Information

Hardware

Software

Known Vulnerabilities

Gather Mission Information

Resource Development

Acquire Infrastructure

Ground Station Equipment

Commercial Ground Station Services

Spacecraft

Compromise Infrastructure

Mission-Operated Ground System

3rd Party Ground System

3rd-Party Spacecraft

Obtain Capabilities

Exploit/Payload

Cryptographic Keys

Stage Capabilities

Identify/Select Delivery Mechanism

Upload Exploit/Payload

Initial Access

Compromise Supply Chain

Software Dependencies & Development Tools

Software Supply Chain

Hardware Supply Chain

Compromise Software Defined Radio

Crosslink via Compromised Neighbor

Secondary/Backup Communication Channel

Ground Station

Receiver

Rendezvous & Proximity Operations

Compromise Emanations

Docked Vehicle / OSAM

Proximity Grappling

Compromise Hosted Payload

Compromise Ground Station

Compromise On-Orbit Update

Malicious Commanding via Valid GS

Rogue External Entity

Rogue Ground Station

Rogue Spacecraft

Trusted Relationship

Mission Collaborator (academia, international, etc.)

Vendor

User Segment

Exploit Reduced Protections During Safe-Mode

Auxiliary Device Compromise

Assembly, Test, and Launch Operation Compromise

Execution

Position, Navigation, and Timing (PNT) Geofencing

Trigger Single Event Upset

Replay

Command Packets

Bus Traffic

Flooding

Erroneous Data

Valid Commands

Modify Authentication Process

Compromise Boot Memory

Exploit Hardware/Firmware Corruption

Design Flaws

Malicious Use of Hardware Commands

Disable/Bypass Encryption

Time Synchronized Execution

Absolute Time Sequences

Relative Time Sequences

Exploit Code Flaws

Flight Software

Operating System

Known Vulnerability (COTS/FOSS)

Inject Malicious Code

Exploit Reduced Protections During Safe-Mode

Modify On-Board Values

Registers

Internal Routing Tables

Memory Write/Loads

App/Subscriber Tables

Scheduling Algorithm

Science/Payload Data

Propulsion Subsystem

Attitude Determination & Control Subsystem

Electrical Power Subsystem

Command & Data Handling Subsystem

Watchdog Timer (WDT)

System Clock

Poison AI/ML Training Data

Side-Channel Attack

Spoofing

Time Spoof

Bus Traffic

Sensor Data

Exfiltration

Side-Channel Attack

Power Analysis Attacks

Electromagnetic Leakage Attacks

Traffic Analysis Attacks

Timing Attacks

Thermal Imaging attacks

Replay

Eavesdropping

Uplink Intercept

Downlink Intercept

Out-of-Band Communications Link

Proximity Operations

Modify Software Defined Radio

Compromised Ground Station

Compromised Developer Site

Compromised Partner Site

Persistence

Memory Compromise

Backdoor

Hardware

Software

Ground System Presence

Replace Cryptographic Keys

Defense Evasion

Disable Fault Management

Prevent Downlink

Inhibit Ground System Functionality

Jam Link Signal

Inhibit Spacecraft Functionality

Modify On-Board Values

Vehicle Command Counter (VCC)

Rejected Command Counter

Command Receiver On/Off Mode

Command Receivers Received Signal Strength

Command Receiver Lock Modes

Telemetry Downlink Modes

Cryptographic Modes

Received Commands

System Clock

GPS Ephemeris

Watchdog Timer (WDT)

Poison AI/ML Training Data

Masquerading

Exploit Reduced Protections During Safe-Mode

Modify Whitelist

Lateral Movement

Hosted Payload

Exploit Lack of Bus Segregation

Constellation Hopping via Crosslink

Visiting Vehicle Interface(s)

Impact

Deception (or Misdirection)

Disruption

Denial

Degradation

Destruction

Theft

Threat actors may attempt to steal the data that is being gathered, processed, and sent from the victim SV. Many SVs have a particular purpose associated with them and the data they gather is deemed mission critical. By attempting to steal this data, the mission, or purpose, of the SV could be lost entirely.

ID: CM0000

Sub-techniques: No sub-techniques

Related Aerospace Threat IDs: SV-AC-1 SV-AC-3 SV-CF-1 SV-CF-2 SV-SP-3 SV-SP-4

Related MITRE ATT&CK TTPs: No related MITRE ATT&CK TTPs

ⓘ

Tactic: Impact

Created: 2022/10/19

Last Modified: 2022/10/28

Countermeasures

ID		Name	Description	NIST Rev5	D3FEND	ISO 27001
CM0000		Countermeasure Not Identified	This technique is a result of utilizing TTPs to create an impact and the applicable countermeasures are associated with the TTPs leveraged to achieve the impact	None	None	None

References

Epstein, Keith and Elgin, Ben. (2008). Tech - Network security breaches & NASA (V.G.Read). Retrieved on February 17, 2013, from http://spoonfeedin.blogspot.com.au/2008/11/tech-network-security-breachesnasa.Html
Thornburgh, Nathan. (2005). The Invasion of the Chinese Cyberspies. Retrieved on March 28, 2013, from http://www.time.com/time/magazine/article/0,9171,1098961,00.html
Martin, P. K.:NASA Cybersecurity: An Examination of the Agency’s Information Security In: Testimony before the Subcommittee on Investigations and Oversight, House Committee on Science, Space, and Technology February 2012 Url:https://oig.nasa.gov/docs/FINAL_written_statement_for_%20IT_%20hearing_February_26_edit_v2.pdf Retrieved 08/07/2019
Leyden, J.: Royal Navy hacker claims to have broken into space agency site Url: https://www.theregister.co.uk/2011/04/18/esa_website_hack/ Retrieved 08/07/2019
Storm, D.:Attackers hack European Space Agency, leak thousands of credentials 'for the lulz' Url: https://www.computerworld.com/article/3014539/attackers-hack-european-space-agency-leak-thousands-of-credentials-for-the-lulz.html December 2014 Retrieved 09/07/2019
Thomson, I.:Hackers mirror 250GB of NASA files on the web Url: https://www.theregister.co.uk/2016/02/01/250gb_nasa_data_hacked/ February 2016 Retrieved 09/07/2019
Williams, C: Houston, we've had a problem: NASA fears internal server hacked, staff personal info swiped by miscreants Url: https://www.theregister.co.uk/2018/12/18/nasa_server_hack/ December 2018 Retrieved 09/07/2019
spaceref.com: Potential Personally Identifiable Information (PII ) Compromise of NASA Servers Url: http://spaceref.com/news/viewsr.html?pid=52074 December 2018 Retrieved 09/07/2019
Cappaccio, Tony and Bliss, Jeff: China Suspected in Attacks on U.S. Satellities October 27 2011
Windsor, C., Malicious Actor Discloses FortiGate SSL-VPN Credentials, https://www.fortinet.com/blog/psirt-blogs/maliciousactor-discloses-fortigate-ssl-vpn-credentials, 2021, Retrieved October 27, 2022.
Abrams, L., Hackers leak passwords for 500,000 Fortinet VPN accounts, https://www.bleepingcomputer.com/news/security/hackers-leak-passwords-for-500-000-fortinet-vpn-accounts/ , 2021, Retrieved October 27, 2022.