# Death By A Thousand COTS: Disrupting Satellite Communications using Low
Earth Orbit Constellations

Frederick Rawlins  University of Oxford
Richard Baker  University of Oxford
Ivan Martinovic  University of Oxford

###### Abstract

Satellites in Geostationary Orbit (GEO) provide a number of commercial,
government, and military services around the world, offering everything from
surveillance and monitoring to video calls and internet access. However a
dramatic lowering of the cost-per-kilogram to space has led to a recent
explosion in real and planned constellations in Low Earth Orbit (LEO) of
smaller satellites.

These constellations are managed remotely and it is important to consider a
scenario in which an attacker gains control over the constituent satellites.
In this paper we aim to understand what damage this attacker could cause,
using the satellites to generate interference.

To ground our analysis, we simulate a number of existing and planned LEO
constellations against an example GEO constellation, and evaluate the relative
effectiveness of each. Our model shows that with conservative power estimates,
both current and planned constellations could disrupt GEO satellite services
at every groundstation considered, with effectiveness varying considerably
between locations.

We analyse different patterns of interference, how they reflect the structures
of the constellations creating them, and how effective they might be against a
number of legitimate services. We found that real-time usage (e.g. calls,
streaming) would be most affected, with 3 constellation designs able to
generate thousands of outages of 30 seconds or longer over the course of the
day across all groundstations.

##  I Introduction

###  I-A Motivation

Space infrastructure underpins an array of services that the world relies
upon, including GNSS for navigation and timing, broadcast media and internet
access in remote areas. Historically, the cost and complexity of developing
and deploying space infrastructure was so vast that it was accessible only to
the most well-funded government and commercial entities. However, a ‘New
Space’ revolution is underway, bringing orbital operations within the reach of
a far larger number of entities, enabled by the development of flexible,
commodity hardware; multi-tenanted launches; and an ecosystem of support
services that have come about together [1].

Noting this vast expansion in the quantity of space infrastructure, emergence
of new services (presenting more attack surface), and the newfound ease with
which more participants can launch their own satellites, there is a novel
potential for Downlink Interference Attacks (DIAs) by current constellations
and those planned for the future. Despite the substantial disparity in
transmission power between the attacker and victim satellites, the difference
in orbital distance and the far greater number of potential attacking
satellites make an attack such as this important to consider.

Figure 1: An illustration of the attack setup. Three LEO satellites with
signals reaching the victim receiver, interfering with the legitimate signal
(centre).

For years, terrestrial Distributed Denial of Service (DDoS) attacks have
mostly used ‘botnets’ composed of thousands of compromised computers to
disrupt services across the internet [2]. An attack of this scale may seem
disproportionate for space, but there are a number of multi-thousand satellite
constellations planned. It is therefore worth examining whether these
constellations might represent the same threat. They would operate on slightly
different principles, relying on the fact that with a sufficiently dense
constellation, there will always be a satellite close to the line between the
victim satellite and groundstation, where interference would be strongest.
However, the same attack vector exists: thousands of near identical systems
that cannot be air-gapped, and could potentially be compromised from almost
anywhere on Earth.

Our paper seeks to explore the following research questions:

  1. 1.

How much interference can different LEO constellations generate?

  2. 2.

How is interference affected by the location of the receiver?

  3. 3.

Which of the current or planned constellations would be most effective (and
therefore potentially more appealing as a target of malware)?

  4. 4.

How are different legitimate uses of GEO satellites affected?

###  I-B The Attack

It is recognised that interference between satellites operating at the same
frequencies can lead to degraded communications [3]. As such, modern LEO
constellations are required by regulators like the Federal Communications
Commission (FCC) to address how they plan to avoid interference with existing
infrastructure. As evidenced from the filings themselves, they take a good-
faith, proactive approach to this by “ensuring that there is the necessary
amount of angular separation” between themselves and potential victim
satellites when targeting groundstations [4, p. 27]. This works because the
receiving antenna will have much greater reception (gain) at the angle
directly towards its intended satellite. This interference-avoidance therefore
relies on each component of the constellation continually monitoring its own
position relative to a number of other satellites to avoid broadcasting in
case of insufficient angular separation as seen in Fig. 2.

In our case, the attacker either does not implement this measure, or overrides
it, and we see the re-enabling of the centre satellite as shown in Fig. 1.

Figure 2: Current interference avoidance mechanisms based on selectively
disabling communications with low angular separation ($\theta<\epsilon$ for
some threshold $\epsilon$).

###  I-C Contributions

  * •

We establish a simulation framework for Downlink Interference Attacks.

  * •

We evaluate current and planned constellations’ effectiveness at jamming the
Inmarsat Global Xpress system in the Ku/Ka bands.

  * •

We find notably that some existing constellation would be sufficient to
systematically jam Inmarsat’s service around the world.

  * •

We discuss the limitations of CubeSats in the communications space, and their
potential for disrupting GNSS services.

##  II Background

###  II-A SDRs in Space

SDRs have dramatically lowered the barrier to entry for satellite operators,
and increased flexibility. The ability to change frequency, modulation,
encoding schemes, and processing on the fly enables a much more dynamic and
adaptable system.

Licenses for space operation give strict frequency bands and operating
parameters for satellites. As identified in [5], a satellite developer must
provide a transmitter survey and potentially verification of emission
characteristics, however these mostly rely on a benign satellite operator
providing trustworthy data [6, 7]. The adversarial analysis done by Pavur et
al. shows that physical changes are limited by size and power, but software is
extremely difficult to completely externally verify without a detailed code
review, which is currently neither conducted nor required.

This means satellites verified for one mode of operation on the ground can
change once in orbit. They have the physical capability through the use of
SDRs and wide-band antennas to broadcast at frequencies beyond their license,
and due to the congested nature of frequency band allocation, this possible
band of operation will almost certainly overlap with other satellites.

Figure 3: CubeSat in Orbit - NASA

(a) Starlink

(b) OneWeb

(c) Planet Labs’s Dove

Figure 4: Three of the constellations used, each with a different structure.

###  II-B CubeSats

Satellite architecture is one of the key changes in the shift towards low-cost
‘small sats’ [8]. This has been dubbed the era of ‘New Space’ [1], and the
clear differences in both technology and attitude present a host of potential
vulnerabilities, while also improving on some specific areas of security.

‘Old Space’ satellites were almost all built by governments or large
defence/communication companies. Every satellite was custom-built for its
mission over a span of years, and excessively tested on the ground to ensure
its success and reliability in space. Not only would each satellite have been
extremely expensive, as it was using proprietary hardware and software, its
trip to space would have been too, coming in at $54,500/kg[9]. At an average
mass of 3,000kg111Exact value: 3,002kg. Calculated as the average of all
launch masses of satellites currently in orbit greater than 500kg.Database:
https://www.ucsusa.org/resources/satellite-database., that gives a launch cost
of $163 million. These satellites had very little focus on security, and
extensive interception of signals from the Iridium Constellation has already
been well documented[10]. Iridium’s reliance on security-through-obscurity was
shared by many other manufacturers and operators of similar size satellites,
and with the advent of SDRs these satellites are rapidly becoming more
accessible to malicious third parties.

‘New Space’ satellites on the other hand make use of commercial-off-the-shelf
(COTS) hardware for the most part, drastically reducing costs and development
time. This is largely in part due to the CubeSat Design Specification, which
has presented a modular standard for others to build upon. Kits are available
online providing a majority of the CubeSat components pre-built for as little
as $7,000[11]. Even non-CubeSats, like the satellites in the Starlink
constellation, are using COTS hardware alongside their own proprietary
hardware.

In general these CubeSats are significantly less powerful than traditional
‘Old Space’ satellites, since they focus on being small, light, and easy to
build. However this cheap approach is reflected not only in their physical
hardware and software, but also in their orbit. Many larger satellites expend
a great deal of energy, propellant, and money to achieve a Geo-stationary
Orbit’ (GEO) (roughly 35,000km away). This is the perfect distance from Earth
where a satellite’s orbit matches the rotation of the Earth underneath it,
allowing it to remain ‘fixed’ in the sky. and able to view a large percentage
of the ground (sometimes up to 1/3${}^{\text{rd}}$ of Earth’s surface area).
This is also used for imaging and defence satellites to enable them to focus
on a specific place the entire time. CubeSats take a much cheaper approach.
They exist in Low Earth Orbit (LEO) instead, (~550 km), often because a rocket
can carry a large number of small satellites at once to this lower orbit
(sometimes 100+[12]), reducing the price for each customer. Another key
advantage of LEO lies in the shorter signal path to Earth and back. What the
satellites lose in coverage, they dramatically gain in signal strength. This
is understandably important when using COTS SDRs and antennas, since much more
powerful communications systems would be required in GEO, or on Earth to
compensate. The final advantage, and the most crucial for satellites like
Starlink, is the lower latency. In order to achieve the responsiveness
required for real time video calls, gaming, and streaming, the latency must be
at least of the same order of magnitude as terrestrial broadband (20 ms). It’s
clear then that GEO, where the round trip for light is 200 ms not including
any processing at either end, would never be feasible, whereas Starlink in its
orbit of roughly 550 km has been measured to have a latency of 45 ms.

As established however, each satellite in LEO can see much less of the Earth
at any given point. Moreover, it is only above that point for a matter of
minutes before its rapid orbit takes it over the horizon. If global coverage
is desired, then hundreds or thousands of satellites are required, which is
the basis for constellations.

Attack |  Military |  Intelligence Agency |  Corporate Insider |  Hardware Supplier |  APT |  Organised Crime |  Terrorist Group |  Individual Hacker |  Activist Group
---|---|---|---|---|---|---|---|---|---
Constellation Launch |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  $\mathrm{x}$ |  $\mathrm{x}$ |  $\mathrm{x}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$ |  $\mathrm{x}$ |  ${\color[rgb]{1,.5,0}i}$
Pre-Launch Tampering |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$
In-Space Tampering |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  $\mathrm{x}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  $\mathrm{x}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$
Distributed Jamming |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  $\mathrm{x}$ |  $\mathrm{x}$ |  ${\color[rgb]{0,.5,.5}\checkmark}$ |  $\mathrm{x}$ |  $\mathrm{x}$ |  ${\color[rgb]{1,.5,0}i}$ |  ${\color[rgb]{1,.5,0}i}$
Key: ${\color[rgb]{0,.5,.5}\checkmark}$ \- Attacker is likely both capable of
executing the attack and motivated to do so. c - Attacker is likely capable,
but the vulnerability doesn’t align with motivations. $\mathbf{i}$ \- Attacker
is likely interested in the attack, but has limited capacity to execute it.
$\mathbf{x}$ \- Attacker is likely neither interested in nor capable of
executing the attack. Note: There may be crossover between categories, such as
an insider threat sponsored by an intelligence agency. This matrix is intended
as a demonstrative summary of the four major stages of the attack, with one of
the first three required for execution of the fourth.
TABLE I: Threat Matrix

###  II-C Related Work

The main body of intersatellite interference research, small though it is,
focuses on ensuring that the good faith solutions proposed work to keep
interference at acceptable levels, and the side effects on both systems. The
effectiveness of angular separation and beam control in reducing interference
have been studied with a view to understanding the cost to LEO coverage that
it imposes [13, 14], and steps have been taken to find analytical alternatives
to orbital simulation for efficient interference calculation [15].

These studies however do not take an adversarial perspective or consider a
threat model, and so are not able to provide an answer for a number of our
questions surrounding the potential capabilities of different actors. They
also lack a comparative component considering often a single constellation at
a time, making it much more difficult to generalise the results or find which
constellations might be more appealing for takeover/creation.

“Should We Worry About Interference in Emerging Dense NGSO Satellite
Constellations?” [16] studies a number of constellations and their
interference effects, but does so with a Monte Carlo approach to satellite
positioning. This Monte Carlo approach provides a more even distribution of
relative positions, but does not allow us to see how interference changes over
time. This is crucial when considering how different interference patters
affect the user’s ability to interact with the system, as explored in Section
VI-A.

##  III Threat Model

Building upon the work done by Pavur et. al to create a template for
understanding space-based threat models [17], in Table I we present a threat
matrix covering major threat actors and capabilities.

The victim considered is a legitimate user of the GEO satellite(s) for
communication or navigation purposes. This might be downloading files, using
it for voice/video calls, receiving location signals, or browsing the
internet.

An attacker in this scenario has either the capability to take control of a
substantial portion of an existing constellation, be it through malicious
cyber attack or state-level take-over, or funding to place a legitimate
constellation into orbit. Their aim is to stop a user on the ground from being
able to extract a legitimate GEO signal from the noisy signal they record,
rendering them unable to receive data.

The specific details of a cyber attack on a constellation are beyond the scope
of this paper, but with growing focus on this potential threat [18, 19], and
increasing use of COTS components/software familiar to existing groups [20],
it is a realistic proposal to consider.

The number of entities with the resources to produce, launch, and maintain a
constellation (even of CubeSats) on the other hand is relatively small. It
requires a large upfront investment in both money and time, covering
development, launch, and orbit raising. Commercial Off The Shelf components
have reduced this investment, but it is still non-trivial.

A few well-funded university research groups might be able to launch 1-10
CubeSats on a ride-share [21]. A consortium of universities and labs could
extend this to a few dozen[22]. From the company perspective, Swarm
Technologies were able to put 120 0.25U CubeSats into orbit[23], but barring
the major constellations such as Starlink, OneWeb, or Iridium, almost every
company with orbital assets has launched fewer than 100 satellites[24].

##  IV Radio Modeling

To estimate interference we need to understand how the signals interact with
each other at the ground. The signal strength depends on the frequency of
signal, the distance between the transmitter and the receiver, the power and
gain of transmitter and receiver, the angle between them, and signal loss to
atmosphere as seen in Eq. 1. We simulate the satellite’s orbital propagation
(Section V-A) and at each time step, with the distances and angles recorded,
we can use Eq. 3 to determine the received power from each satellite. This
allows us to calculate the resulting Signal to Interference plus Noise Ratio
(SINR), by taking the strongest legitimate signal received from the GEO
satellites, and the sum of squares from interfering signals combined with
receiver noise.

SINR gives us an indication of ‘signal clarity’, and is used to determine
whether a groundstation is likely to be able to receive and correctly decode
the legitimate signal.

###  IV-A Transmission Equations

The model itself is a basic representation of RF signals, written as the
following:

$r_{p}=\textit{EIRP}+r_{g}-L-A$ (1) $L=20\cdot\log\left(\dfrac{4\pi
df}{c}\right)$ (2)

For the components of the ratio, power is measured in watts (W) rather than
decibel watts (dBW) as above, though the final SINR is in decibel watts (dBW).

$\displaystyle SINR$ $\displaystyle=\dfrac{S}{(N+I)}$ (3)
$\displaystyle=\dfrac{\max(C_{i})}{N+\sqrt{\sum_{j=1}^{n}I_{j}^{2}}}$ (4)

EIRP $\displaystyle=\text{Effective Isotropic Radiated Power (dBW)}$
$\displaystyle r_{p}$ $\displaystyle=\text{Received Power (dBW)}$
$\displaystyle r_{g}$ $\displaystyle=\text{Receiver Antenna Gain (dBW)}$
$\displaystyle L$ $\displaystyle=\text{Free Space Path Loss (dBW)}$
$\displaystyle A$ $\displaystyle=\text{Atmospheric Attenuation (dBW)}$
$\displaystyle d$ $\displaystyle=\text{Distance (m)}$ $\displaystyle f$
$\displaystyle=\text{Frequency (Hz)}$ $\displaystyle b$
$\displaystyle=\text{Bandwidth (Hz)}$ $\displaystyle c$
$\displaystyle=\text{Speed of Light (ms${}^{-1}$)}$

###  IV-B Receiver Equations

The receiver is modeled according to the European Radiocommunications
Committee’s (ERC) report on analysis of Inmarsat receivers [25] (with
$G_{\max}=44$ [26]) which for 19.2 GHz (Inmarsat’s downlink frequency) gives:

$\displaystyle
G(\phi)=\begin{cases}G_{\max}-\left(\frac{D}{\lambda}\cdot\frac{\varphi}{20}\right)^{2}&\text{
for }0<\varphi<\varphi_{11}\\\ G_{1}&\text{ for
}\varphi_{m}<\varphi<100\frac{\lambda}{D}\\\
52-10\log\frac{D}{\lambda}-25\log\varphi&\text{ for
}100\frac{\lambda}{D}\leq\varphi<48\\\ -10&\text{ for }\varphi>48\end{cases}$
(5)

This is adapted slightly since the values coming out of the simulation have
$90$\mathrm{\SIUnitSymbolDegree}$$ as directly overhead, so we end up with the
graph in Fig. 5.

Figure 5: The gain of the receiver modeled, where
90$\mathrm{\SIUnitSymbolDegree}$ is directly facing the GEO satellite, and LEO
satellites will have a lower gain based on their angle to the receiver.

###  IV-C Values

The following values were used throughout:

$\displaystyle A$ $\displaystyle=\text{0.35 dBW}$ $\displaystyle t$
$\displaystyle=\text{290 k}$ $\displaystyle f$ $\displaystyle=\text{19.2 GHz}$
$\displaystyle b$ $\displaystyle=\text{250 MHz}$

$A$ approximating atmospheric attenuation [27], $t$ approximating room
temperature for the receiver, $f$ set as the Inmarsat downlink frequency
(still covered by the Ka and Ku Starlink transmitters), and $b$ for the
bandwidth of the signal [28].

Rain attenuation is not modeled, but assuming clear skies for the simulation,
this is negligible [27].

##  V Evaluation

###  V-A Simulation

####  V-A1 Simulator Details

The satellite simulations were done in FreeFlyer, an orbital propagation
program designed to simulate mutliple groundstations, satellites, and
celestial bodies over a period of time. This takes known satellite positions
and orbits, and steps through to calculate their position over time. A number
of techniques are available to do this efficiently, though we use FreeFlyer’s
default for simplicity 222Runge Kutta 8(9) Integrator, with a fixed step size
of 300s, and a Relative Error Tolerance of 1e-9, with Norad SGP4 for TLEs..

Atmospheric drag is included in the simulation, though not relevant for the
timescales involved.

For picking a relevant and varied group of Ground Station locations, we chose
those listed as AWS Ground Stations 333https://aws.amazon.com/ground-
station/locations/ as show in Fig. 6. These are 10 stations around the world,
and as the Ground-Station-As-A-Service industry grows, may represent a
substantial part of satellite-ground communications. While fairly evenly
distributed longitudinally, they are focused mostly in the Northern
Hemisphere.

As listed in Section IV, we are using an Inmarsat specific antenna pattern, so
the use of AWS groundstations is just for representative location rather than
hardware.

Figure 6: AWS Groundstation locations used as reference for receiver. Constellation |  Status |  Number |  Satellite |  EIRP (dBW) |  Orbit (km)
---|---|---|---|---|---
Inmarsat Global Xpress (Victim) |  Exists |  150 |  Global Xpress |  80 |  35,000
PlanetLabs Dove Constellation |  Exists |  150 |  Dove |  15 |  530
CubeSat Walker Constellation |  Hypothetical |  396 |  CubeSat |  6 |  550
Starlink First Group |  Exists |  1,584 |  Starlink |  45 |  550
Starlink Phase 1 |  Planned |  4,408 |  Starlink |  45 |  550
One Web Phase 1 |  Planned |  716 |  OneWeb |  51 |  1,200
One Web Phase 2 |  Planned |  6,372 |  OneWeb |  51 |  1,200
Note: Due to limited public information, the numbers here come from a variety
of sources, or represent best estimations from available public filings. See
Appendix A for more details.
TABLE II: Constellation Details

####  V-A2 Inmarsat

The victim group of GEO satellites chosen belong to the Inmarsat Global Xpress
Series. These were chosen as they represent an existing communications
network, exemplify well the ‘Old Space’ approach of few, powerful satellites,
and operate in the same frequency bands as Starlink and OneWeb (Ku/Ka band).

Inmarsat do not release much information about the power of their satellites,
however the limited information on the 2, 3, 4 series as well as the then
upcoming Alphasat (which became Inmarsat-4A F4) give the maximum EIRP link of
70 dBW[29].

The orbits for the 5 satellites comprising the GX series were taken from
Celestrak TLEs [24].

####  V-A3 Constellations

The simulation accepts both existing Two-Line Element sets (TLEs), or
constellations specified via the GUI or scripting language. TLEs are a format
of storing satellite positions and orbits, allowing tracking. For the paper, a
number of different constellations ([30, 31, 32]) were modelled as the
interfering party, using:

  * •

PlanetLabs’ Dove Constellation

  * •

CubeSat Walker Constellation

  * •

Starlink

  * •

Starlink Phase 1

  * •

One Web Phase 1

  * •

One Web Phase 2

Further details can be found in Table II.

####  V-A4 Simulation Steps

Once the groundstations, lower constellation, and higher constellation have
been specified, the simulation can be run with a number of other variable
parameters. For the results below, the simulation was run with a propagation
step size of 10 seconds, and a total elapsed time of 24 hours.

At every given step, each groundstation calculates all LEO satellites visible
(determined by greater than 15 degrees above the horizon). It also calculates
which GEO satellite has the strongest received signal. For each of these it
stores distance, azimuth, and elevation for the model discussed in Section IV.

The advantage of separating the orbital simulation from the RF simulation is
that a single orbital simulation can be used repeatedly by the RF model,
varying parameters such as power and frequency, and changing the satellite
selection process (e.g. elevation over a specific angle). This dramatically
reduces the amount of repeated computation required for each total run of the
pipeline.

To further improve efficiency, when processing the RF model, we can calculate
only the distance based factor of the Free Space Path Loss, and add the
constant and frequency components afterwards, as see in Eq. 6

$\displaystyle FSPL$ $\displaystyle=20\cdot\log\left(\dfrac{4\pi\cdot
1000\cdot d\cdot f}{c}\right)$ (6)
$\displaystyle=20\cdot\log\left(d\right)+20\cdot\log\left(\dfrac{4\pi\cdot
1000}{c}\right)+20\cdot\log\left(f\right)$ (7)
$\displaystyle=20\cdot\log\left(d\right)-87.55221678+20\cdot\log\left(f\right)$
(8)

where $d=\text{Distance in km}$. This allows us to calculate the
‘contribution’ of each satellite once, based on FSPL and user terminal antenna
gain, and vary the frequency and power used by the satellites afterwards to
determine final interference (as used in Fig. 7(a)).

Both the orbital propagation and RF simulation code will be made publicly
available at https://github.com/ssloxford to assist additional security
research into satellite interference in future.

###  V-B Results

With no interference, the average received signal strength from Inmarsat was
$-96.02$ dBW, with an SINR of $23.98$ dBW. However, with the added
interference from each constellation considered independently, we see the
results in III.

TABLE III: Mean Interference Results Name |  Mean SINR (dBW) |  Mean Time Jamming (%) |  Mean period of jamming (s)
---|---|---|---
Dove |  23.94 |  0 |  0
CubeSat |  23.96 |  0 |  0
Starlink |  13.27 |  12.41 |  31.25
Starlink Phase 1 |  9.80 |  27.35 |  38.88
OneWeb |  15.56 |  7.36 |  47.52
OneWeb Phase 2 |  3.81 |  77.67 |  150.67

However, as we will see from analysing individual ground stations, these
averages obscure a large amount of information, and do not necessarily paint
an accurate picture.

####  V-B1 Feasibility of Denial of Service

(a) Starlink

(b) Starlink Phase 1

Figure 7: Time spent jamming over 24 hours as a function of the power of each
satellite in the constellation. Starlink Phase 1 has triple the number of
satellites, which reduces the per-satellite power required to achieve the same
jamming.

Here ‘jamming’ is defined as bringing the SINR below 10 dBW. This specific
number is somewhat arbitrary444Most services do not publish such low-level
numbers, but one service lists 10 dBW as required to show correct alignment
[33]., but allows us to set some threshold for analysis.

Fig. 7(a) shows us how often the attacker could expect to be jamming as the
power of the satellite scales. For Starlink, with EIRP of 39 dBW, it means
that for all groundstations barring Stockholm there would be disruption
$5-15\%$ of the time. Jamming is clearly feasible then, and affected greatly
by the individual power of each satellite though as constellations of greater
number are considered, such as Starlink Phase 1, the number of satellites can
make up for lack of individual power (see Fig. 7(b)) on the order of roughly 5
dBW (or roughly 3.16 times less power).

####  V-B2 Effect of Groundstation Location

From the groundstation curves we can see that the non-uniform layout of the
constellation gives different effectiveness at different groundstations. Even
if the curves between stations are similar, their slight offset and rapid
growth means that for the same power level they might experience very
different jamming results.

Figure 8: Starlink SINR at Manama over 24 hours. Every point represents 10
seconds, and each spike below 10 dBW is considered to be jamming. Figure 9:
Starlink SINR at Stockholm over 24 hours

For example, comparing the SINR directly over the course of the 24 hours
between Manama and Stockholm we can see the sporadic coverage given to Manama
in Fig. 8 compared to the denser coverage over Stockholm (Fig. 9), an effect
noted in [15]. Due to its inclination of $53.2$\mathrm{\SIUnitSymbolDegree}$$,
Starlink has a much higher density near groundstations like Dublin and
Stockholm ($53.3$\mathrm{\SIUnitSymbolDegree}$$ and
$59.3$\mathrm{\SIUnitSymbolDegree}$$ latitude respectively), than the likes of
Honolulu and Manama ($21.3$\mathrm{\SIUnitSymbolDegree}$$ and
$26.2$\mathrm{\SIUnitSymbolDegree}$$ latitude respectively). This shows how
important specific orbital parameters, as well as the locations an attacker
wishes to jam, are in determining the potential jamming effectiveness of a
constellation. A satellite’s position relative to the vector between
groundstation and victim target (and how often it intercepts this vector) can
matter much more than the satellite’s power.

However satellite power is not to be discounted. There is a clear minimum
power required on all curves seen, and after that it looks like linear order
growth (though shown on a logarithmic scale), until it plateaus at the very
end. Doubling in power therefore approximately doubles the time spent jamming.

####  V-B3 Effect of Constellation Choice

However, not all constellations exhibit the patterns shown above. OneWeb, for
example, has a much more cyclic and predictable nature.

Figure 10: OneWeb SINR at Manama over 24 hours

We can see that less time is spent jamming overall, but it is much clearer
when that happens, and easier to predict.

Figure 11: Groundstation curves for OneWeb with a threshold of 10 dBW

Looking at time jamming across all ground stations for OneWeb as seen in Fig.
11 the lower number of satellites, higher orbit, and strict periodic nature of
the jamming leaves it much less effective than Starlink, despite the higher
power of each satellite.

Figure 12: OneWebPhase2 SINR at Manama over 24 hours

Contrasting constellations based on density, such as between OneWeb (Fig. 10)
and OneWeb Phase 2 (Fig. 12), we can also see how much of a difference the
‘secondary’ satellites make (those not directly between the groundstation and
victim satellite). The greatest difference between the single strongest
interfering satellite, and the sum of all interfering satellites is $\approx
5$ dBW for One Web Phase 2.

####  V-B4 CubeSat vs. Commercial New-Space

So far we have still been considering constellations with hundreds or
thousands of relatively powerful satellites however. Looking at the other end
of the spectrum, at a much more achievable CubeSat constellation, the results
are very different.

Figure 13: Groundstation curves for a CubeSat Walker Constellation with a
threshold of 10 dBW

The CubeSat constellation (Fig. 13) itself has better performance compared to
OneWeb (Fig. 11), with the notable improvement of Stockholm (again explained
by the lower inclination), until a power of 60 dBW. This is currently far
beyond the power achievable at such a scale, and so matters much less in
comparison. The crucial difference however the actual EIRP of each CubeSat
sits at 6 dBW, where no groundstation is being jammed at all. Taking an
example groundstation, in this case Salem, we can see that the constellation
never even comes close to appreciably reducing the SINR.

Figure 14: CubeSat SINR at Salem over 24 hours

##  VI Discussion

The results give a number of interesting considerations. For one, the latitude
makes a large difference, with groundstations closer to the equator suffering
less interference than those higher up. This is chiefly because constellations
with a non-polar inclination (such as Starlink) are much denser at the
latitude of their inclination (53.2 degrees). This means that there are more
secondary satellites contributing, and the primary satellites spend more time
with low angular separation.

Next we can see that the nonlinearity of the SNIR curves (such as Fig. 7(a))
means a relatively small change in power can result in a dramatic increase in
jamming time. Satellite manufacturers are often very restrictive in the
information they provide about their satellites. As such, lots of the
information used is taken from legal filings. This has the unfortunate
consequence that all of the information provided is what the manufacturers
intend to do, not their full capabilities (which is what we care about in an
adversarial scenario). There are numerous references to lowering satellites’
EIRP to acceptable levels, which implies that they are more capable than the
given figures suggest [31]. This makes sense, given that the satellite
operators are continually trying to seek relaxation of regulation. If the
satellites are launched with a higher maximum EIRP, they can adopt it as soon
as legally permitted, rather than building and launching satellites with the
updated specifications. As such, jamming is likely to be more possible than
considered so far, which represents a conservative estimate.

Finally, the results show that CubeSats simply do not have the power required
to compete with most Ka-band services. However, communications are not the
only space-based service in use, Global Navigation Satellite Systems (GNSS)
being a key alternative. The European Space Agency (ESA) and others use S-Band
(2220-2290 MHz down) for Telemetry, Tracking, and Command (TT&C) signals. This
is relatively close to the L1-Band (1575.42 MHz) used by GNSS. A COTS SDR (for
example the TOTEM Nanosatellite SDR Platform [34]) covers 70-6000 MHz, and
therefore a satellite could reasonably use this SDR for operational or
potentially malicious purposes. While interference wouldn’t be effective,
since GNSS is built to deal with extracting a weak signal from background
noise, it does still leave open the option of a replay or spoofing attack to
be explored in future work, since when simulated the CubeSat constellation
still gives a more powerful signal than GNSS as seen in Fig. 15.

Figure 15: A comparison between average simulated GPS signal strength (blue)
compared to average CubeSat signal strength.

(a)

(b)

Figure 16: Figures showing histograms of ‘jamming runs’. These show the
frequencies of time periods of constant interference (SNIR $<10$ dBW).

###  VI-A Usage Analysis

We have seen that constellation design plays a large part in the type of
jamming available, with Starlink and the CubeSats having frequent but
seemingly random spikes, contrasted with OneWeb and more PlanetLabs’ periodic
jamming. This could well be an advantage for an attacker, knowing when a given
system might be down (if only briefly). However if the user/defender is
attentive to this pattern, and does not require 100% uptime, then it may be
very easy for the defender to adapt and instead use the system outside of
these times. One disadvantage for the attacker is that they are completely
constrained by orbital dynamics, and so cannot alter when they jam (though can
choose to jam less than maximally possible). This will clearly work best if
the defender can’t choose to use the system outside of the times of jamming.

We can look more closely at how long each constellation is able to jam for by
plotting a histogram of jamming time across all groundstations. Figure 16
shows this distribution for both Starlink constellations, as well as both
OneWeb constellations. We can see in Fig 16(a), Starlink never jams for longer
than 90 seconds. This means that as long as the timeout period for packets is
longer than 90 seconds, everything should eventually get through. This works
for downloading files, but would render real-time communication via video or
speech unusable. Uploads could in theory remain unaffected, however the TCP
protocol requires acknowledgment within a certain window[35], and if the
interference continues at sufficient strength it might not receive this. In
that case, even uploading would be stopped until connection resumes.

However, Starlink Phase 1 has (limited) interference capability up to almost 3
minutes, and OneWeb Phase 2 has an average period of 2 and half minutes,
happening frequently. This presents a very serious problem for almost any use-
case. Remotely managing systems with consistent two minute delays dramatically
lengthens control feedback loops (i.e. between triggering a command and seeing
the effect), which in industry may have expensive or dangerous consequences,
especially if the satellite communications are used for warning or monitoring
systems [36].

###  VI-B Attack Mitigations

There are a number of measures that a user on the ground might be able to take
to reduce the effectiveness of interference. Chief among them are the use of a
more highly directional antenna and Frequency Hopping Spread Spectrum (FHSS).

The use of more focused antenna pattern dramatically reduces not only the
effect of ‘secondary’ interfering satellites, but also minimises the amount of
time a primary constellation satellite spends at a ‘high-gain‘ angle (i.e.
sufficiently close to the peak gain of the antenna). This does not completely
eliminate the possibility of interference, but limits how often it could cause
serious disruption. An antenna pattern like that recommended by the ITU (Fig.
17) is a good starting point [37].

Figure 17: The current Inmarsat antenna gain pattern (blue), compared to an
alternative recommended by the ITU (orange) that would provide much lower
Interference.

Frequency hopping, the process of suddenly changing operating frequency to
avoid interference, requires much deeper integration by the satellite operator
than simply changing antenna. Both the transmitter (GEO satellite) and the
receiver (user terminal) must be ready to change at the same time, and know
which frequency they are going to next. This is extremely effective at
mitigating interference, since the jamming signal from the constellation would
remain at the previous frequency. This interference will therefore have a
significantly reduced impact if the two frequencies are sufficiently far apart
[38]. Frequency hopping is already commonly implemented on military systems to
reduce interference, as well as in the Bluetooth protocol [39, 40]. This may
be more difficult in satellite communications given the strict limits on
licensed bands, but there are a number of unregulated bands that could be used
for this purpose if needed.

##  VII Conclusion

In this paper we have modeled interference from a variety of current and
planned constellations at a number of groundstations. We found that jamming
would already be possible, and its potential effectiveness is only going to
increase as constellations grow larger. However, even the most effective
constellation design considered, OneWeb Phase 2, would require a minimum EIRP
per satellite of roughly 30 dBW; two orders of magnitude more powerful than
the biggest CubeSats (10 dBW). For Ku/Ka band then, CubeSat interference does
not seem to pose a problem, though it might have serious consequences for GNSS
infrastructure.

This power requirement means that the attack is not open to all ‘New Space’
players, and puts it beyond the reach of the likes of all but large companies
(e.g. SpaceX, OneWeb, Amazon) willing to invest the money into producing a
constellation of such satellites. It is unlikely then that a constellation
dedicated to this attack would be feasible. However targeting an existing or
planned constellation continues to be a viable option, and the security
policies of satellite operators should reflect this.

It is not enough to provide reports on avoiding interference through
modulating power, direction, and operation conditions, as is currently
required, as these all rely on a benign operator. To most effectively minimise
their impact on other space assets, comprehensive external code reviews,
adversarial analysis, and continual monitoring would all help to ensure system
integrity.

The use of off-the-shelf software like Linux is excellent for rapid
development and use of existing libraries, but it also lowers the barrier to
entry for malicious attacks, which we have shown here can have consequences
far beyond the company compromised.

The potential mitigations mentioned in Section VI-B go some way towards
alleviating the potency of such an attack, though these rely on more capable
and therefore expensive receivers, which may limit their implementation.

##  Appendix A Appendix: Satellite Details

Details on satellite characteristics:

###  A-A Dove Satellite

Planet Labs have been extremely open about both the optics and communication
details of their satellites. Given the vast quantity of data produced by the
cameras (80 GB per pass), EIRP is more important for these imaging satellites
than might be initially expected.

Their paper gives clear numbers for EIRP: 8.2 dBW [41].

###  A-B CubeSat

For the example cubesat, we used the EXA Kratos 1U
555https://www.cubesatshop.com/product/kratos-1u-cubesat-platform-1-step-
solution/ Cubesat Platform, with a 6 dBW patch antenna, and 1 W transmission
power, providing an EIRP of 6 dBW.

###  A-C Starlink

Based on the FCC Starlink Attachment, the highest usable EIRP density from
Starlink satellites is 15.70 dBW/4kHz [31]. Since we are assuming bandwidth of
250 MHz, that gives an EIRP $\approx 39.68$ dBW.

###  A-D OneWeb

The OneWeb FCC filing [4] gives a maximum downlink EIRP density of -2.7
dBW/4kHz. Using the same bandwidth as above, that gives a maximum EIRP
$\approx 45.26$ dBW.

##  Appendix B Plots for all Architectures

(a) Starlink

(b) Starlink Phase 1

(c) OneWeb

(d) OneWeb Phase 2

(e) Planet Labs’ Dove

(f) CubeSat

Figure 18: Groundstation curves for all constellations, showing percentage
time jamming as a function of satellite power, with a threshold of 10 dBW.

## References

  * [1] M. Manulis, C. Bridges, R. Harrison, V. Sekar, and A. Davis, “Cyber security in new space,” 2020. [Online]. Available: https://doi.org/10.1007/s10207-020-00503-w
  * [2] E. Alomari, S. Manickam, B. B. Gupta, S. Karuppayah, and R. Alfaris, “Botnet-based distributed denial of service (ddos) attacks on web servers: Classification and art,” _International Journal of Computer Applications_ , vol. 49, 08 2012.
  * [3] FCC. Significant satellite rulemakings. [Online]. Available: https://www.fcc.gov/significant-satellite-rulemakings
  * [4] OneWeb, “Oneweb non-geostationary satellite system (leo) phase 2: Modification to authorized system attachment b,” Tech. Rep., 2019. [Online]. Available: https://fcc.report/IBFS/SAT-MPL-20200526-00062/2379706.pdf
  * [5] J. Pavur, M. Strohmeier, V. Lenders, and I. Martinovic, “In the same boat: On small satellites, big rockets, and cyber trust,” 05 2021, pp. 151–169.
  * [6] NASA. (2017) Cubesat 101: Basic concepts and processes for first-time cubesat developers. [Online]. Available: https://www.nasa.gov/sites/default/files/atoms/files/nasa_csli_cubesat_101_508.pdf
  * [7] Air Force Space Command. Range safety user requirements manual volume 3 - launch vehicles, payloads, and ground support systems requirements. [Online]. Available: https://static.e-publishing.af.mil/production/1/afspc/publication/afspcman91-710v3/afspcman91-710v3.pdf
  * [8] M. N. Sweeting, “Modern small satellites—changing the economics of space,” 2018\. [Online]. Available: https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8303876
  * [9] H. W. Jones, “The recent large reduction in space launch cost,” 2018. [Online]. Available: https://ttu-ir.tdl.org/bitstream/handle/2346/74082/ICES_2018_81.pdf
  * [10] Sec and Schneider. (2015) Iridium hacking: Please don’t sue us. [Online]. Available: https://av.tib.eu/media/38121
  * [11] (2020) Esat. [Online]. Available: https://www.cubesatshop.com/product/esat/
  * [12] SpaceX. (2022) Transporter-3 mission. [Online]. Available: https://www.spacex.com/updates/transporter-3-mission/index.html
  * [13] H. Wang, C. Wang, J. Yuan, Y. Zhao, R. Ding, and W. Wang, “Coexistence downlink interference analysis between leo system and geo system in ka band,” in _2018 IEEE/CIC International Conference on Communications in China (ICCC)_ , 2018, pp. 465–469.
  * [14] R. Li, P. Gu, and C. Hua, “Optimal beam power control for co-existing multibeam geo and leo satellite system,” in _2019 11th International Conference on Wireless Communications and Signal Processing (WCSP)_ , 2019, pp. 1–6.
  * [15] T. Wang, W. Li, and Y. Li, “Co-frequency interference analysis between large-scale ngso constellations and gso systems,” in _2020 International Conference on Wireless Communications and Signal Processing (WCSP)_ , 2020, pp. 679–684.
  * [16] C. Braun, A. M. Voicu, L. Simić, and P. Mähönen, “Should we worry about interference in emerging dense ngso satellite constellations?” in _2019 IEEE International Symposium on Dynamic Spectrum Access Networks (DySPAN)_ , 2019, pp. 1–10.
  * [17] J. Pavur and I. Martinovic, “SOK: building a launchpad for impactful satellite cyber-security research,” _CoRR_ , 2020. [Online]. Available: https://arxiv.org/abs/2010.10872
  * [18] S. Scoles. (2020) The feds want these teams to hack a satellite—from home. [Online]. Available: https://www.wired.com/story/the-feds-want-these-teams-to-hack-a-satellite-from-home/
  * [19] A. I. of Aeronautics and Astronautics. Cubesat cybersecurity challenge. [Online]. Available: https://aerospacevillage.org/wp-content/uploads/2021/08/AIAA_CubeSat_Hacking_Workshop_2021.pdf
  * [20] D. Cassel. The hardware and software used in space. [Online]. Available: https://thenewstack.io/the-hardware-and-software-used-in-space/
  * [21] Virginia cubesat constellation. [Online]. Available: https://vsgc.odu.edu/virginiacubesatconstellation/
  * [22] Qb50: An international network of cubesats. [Online]. Available: https://www.qb50.eu/index.php/consortium.html
  * [23] Newspace index: Swarm technologies. [Online]. Available: https://www.newspace.im/constellations/swarm-technologies
  * [24] Celestrak. [Online]. Available: https://www.celestrak.com/NORAD/elements/
  * [25] E. R. Committee, “Erc report 91 assessment of interference from unwanted emissions of ngso mss satellite transmitters operating in the space-to-earth direction in the band 1621.35 - 1626.5 mhz to gso mss satellite receivers operating in the earth-to-space direction in the band 1626.5 - 1660.5 mhz,” European Conference of Postal and Telecommunications Administrations, Tech. Rep., 2000.
  * [26] Furuno. Advanced ka-band antenna terminal designed for inmarsat global xpress. [Online]. Available: https://www.furuno.com/files/Brochure/306/upload/FV-110GX_EN.pdf
  * [27] Kymeta, “Link budget calculations for a satellite link with an electronically steerable antenna terminal,” Kymeta, Tech. Rep., 2019. [Online]. Available: https://www.kymetacorp.com/wp-content/uploads/2020/09/Link-Budget-Calculations-2.pdf
  * [28] B. C. S. Services. Inmarsat-5: Overview brief for arctic. [Online]. Available: https://www.ntia.doc.gov/files/ntia/boeing_satcom_for_alaska1.pdf
  * [29] Jack Deasy (Director, UAS Programs). Inmarsat update. [Online]. Available: http://faculty.nps.edu/cdprince/mwc/docs/MWC_CONF/2011_-7_19-20_Conf/Deasy_Inmarsat_Intro_and_Program_Update.pdf
  * [30] “Planet labs tles,” Jan 2022. [Online]. Available: https://ephemerides.planet-labs.com/
  * [31] SpaceX, _SpaceX Non-Geostationary Satellite System Attachment A_. FCC, Nov 2018. [Online]. Available: https://fcc.report/IBFS/SAT-MOD-20181108-00083/1569860.pdf
  * [32] OneWeb, “Amendment to modification application for U.S. market access grant for the oneweb ku- and ka-band system,” Tech. Rep., Jan 2021. [Online]. Available: https://fcc.report/IBFS/SAT-MPL-20210112-00007/3495551.pdf
  * [33] bigblu. Technical faqs. [Online]. Available: https://bigblu.ie/technical-faqs/
  * [34] A. Space. Totem nanosatellite sdr platform. [Online]. Available: https://www.cubesatshop.com/product/totem-nanosatellite-sdr-platform/
  * [35] V. Jacobson, R. Braden, and D. Borman, “Rfc 1323: Tcp extensions for high performance,” Network Working Group, Tech. Rep., 1992. [Online]. Available: https://www.ietf.org/rfc/rfc1323.txt
  * [36] E. S. Agency. Using space technology to monitor offshore oil and gas fields. [Online]. Available: https://www.esa.int/Applications/Technology_Transfer/Using_space_technology_to_monitor_offshore_oil_and_gas_fields
  * [37] ITU. Reference FSS earth-station radiation patterns for use in interference assessment involving non-gso satellites in frequency bands between 10.7 GHz and 30 GHz. [Online]. Available: https://www.itu.int/dms_pubrec/itu-r/rec/s/R-REC-S.1428-1-200102-I!!PDF-E.pdf
  * [38] Z. Kostic, I. Maric, and X. Wang, “Fundamentals of dynamic frequency hopping in cellular systems,” _IEEE Journal on Selected Areas in Communications_ , vol. 19, no. 11, pp. 2254–2266, 2001.
  * [39] C. Brown and P. J. Vigneron, “Robust frequency hopping for high data rate tactical communications,” Tech. Rep. [Online]. Available: https://www.sto.nato.int/publications/STO%20Meeting%20Proceedings/RTO-MP-IST-054/MP-IST-054-P12.pdf
  * [40] J. Marcel. How bluetooth technology usesadaptive frequency hopping to overcome packet interference. [Online]. Available: https://www.bluetooth.com/blog/how-bluetooth-technology-uses-adaptive-frequency-hopping-to-overcome-packet-interference/
  * [41] K. Devaraj, M. Ligon, E. Blossom, J. Breu, B. Klofas, K. Colton, and R. W. Kingsbury, “Planet high speed radio: Crossing gbps from a 3U cubesat,” Tech. Rep., 2019.