Journey of a Cyberwarrior: Hacking the Skies part II

Welcome to… “Journey of a Cyberwarrior” Hacking the Skies part II

As always, a warm welcome to all returning subscribers, and to newcomers, welcome aboard warriors!

Last time we started exploring the fascinating world of satellites, we’ve talked about a little bit of history, satellites instruments, satellites orbits, just a hint of networking and the various attacks can be performed.

This time, we’ll dive deep into all the various attack types and how they are performed, we’ll explore the famous Brazilian Sat-Hack and much more.

Before we venture deeper into this dark yet crucial domain, it's important to acknowledge the weight of what we are about to explore. The vulnerabilities we discuss are not theoretical, they exist in real-world systems, with real-world consequences. This knowledge is powerful, but with power comes responsibility. Some critical steps and information have been deliberately omitted due to their highly illegal nature. Our purpose here is education and defense, not exploitation.

Okay, with that being said, let’s begin shall we?

Perhaps in the last article you read “the Brazilian Sat-Hack” and thought “what the heck is he blabbering about?”

The story begins in the vast, untamed wilderness of Brazil. The Amazon, stretching endlessly, is a place where communication is often as scarce as civilization itself. In this land of dense jungles and isolated roads, truckers, loggers, and even criminals found themselves in desperate need of a way to talk to one another, then, someone had an idea.

Sometime in the mid ‘90s, an unknown radio enthusiast stumbled upon an open frequency, one that shouldn't have been available to the public. It came from the skies, beaming down from an American satellite, part of the U.S. Navy's Fleet Satellite Communications (FLTSATCOM) system. It was designed for military use however, these satellites were never encrypted, never secured against the curious minds who knew how to tinker with radio frequencies, who would have thought that the military (the same military where governments around the world spend millions and even billions of dollars every year) would use unencrypted communications?

So, the word spread like wildfire, soon, truck drivers, rogue loggers, and even university professors were building and modifying radio transmitters, transforming them into devices capable of reaching the satellites. They called it Bolinha meaning "little ball", a secret name whispered among those who knew.

For those involved, it was a revolution, truckers, who once relied on weak CB radios, now had the ability to talk across the entire country. Illegal loggers, seeking to avoid law enforcement, used it as their private warning system and in the shadows, criminal organizations realized that this stolen satellite network was perfect for coordinating illicit activities without detection.

The process was deceptively simple. A person would take a standard ham radio operating in the 144-148 MHz range, crack it open, and tweak its internals. By adding a frequency doubler, constructed using coils and a varactor diode, they could force the signal into the 292-317 MHz band, the exact frequencies used by the Navy satellites. A homemade antenna, often cobbled together from scrap materials was all that was needed to ensure a strong signal.

The satellites, floating high above, didn’t care who was talking. They simply relayed the voices back to Earth, allowing conversations to be heard from thousands of kilometers away. To the people using it, it was as if they had built their own pirate telecommunications system, completely free and impossible to regulate.

For over a decade, this went unnoticed, or at least, ignored however, the U.S. Navy wasn’t deaf to the noise, somewhere in an American military office, engineers and officers were puzzled by the bizarre Portuguese chatter echoing through their communication systems. "Bolinha" had grown too large to be ignored.

Then came March 2009.

The Brazilian Federal Police, working alongside the U.S. Department of Defense and Anatel (Brazil’s telecommunications regulatory agency), launched (creatively enough) Operation Satellite, the first major crackdown on the illegal satellite users. Across six states, law enforcement moved in, seizing equipment and arresting 39 individuals.

Some were ordinary people like farmers, electricians, even a university professor, others had more sinister ties, connected to organized crime and illegal deforestation operations. The government made an example of them, charging them with unauthorized telecommunications usage, a crime that could result in up to four years in prison.

The truth is, this wasn’t just a crime, it was a testament to human ingenuity, a group of individuals, armed with little more than knowledge and desperation, had managed to hijack a military satellite system and turn it into their own private network, it was both brilliant and illegal.

Even after the arrests, whispers remained, suggesting that somewhere, in the deep forests of Brazil, voices still floated through the stolen airwaves, carried by satellites that were never meant to listen. Sometimes you don’t need to be a genius, just a little bit of knowledge and courage and you can achieve anything. Now I’m not saying you should go outside and hijack a satellite, but just how simple sometimes it can be.

Hijacking does not necessarily mean take control of the satellite and crash it into another satellite or into earth, it means you can transform it into your personal transmitter or receiver.

The common misconception about satellites is that they are fortresses in orbit, safeguarded by layers of encryption, complex access controls, and top-tier cybersecurity. The reality is far less impressive. Some satellites, even those used for military applications, remain unencrypted. Others rely on outdated communication protocols, and many orbiting assets were never designed with active defense mechanisms in mind. The truth is that satellite hacking is not as difficult as it should be. While true full-system control is complex, unauthorized access, data interception, and even complete service denial are often incredibly simple.

The attack surface of a satellite is divided into three main components: the satellite itself, the communication link, and the ground control infrastructure. The easiest targets are almost always the communication links, as many still rely on radio frequencies that can be intercepted, jammed, or even injected with false data. The second most vulnerable target is often the ground station, which, if compromised, can lead to full operational control of the satellite. Directly hacking a satellite in orbit is far more complex but not impossible.

I cannot stress this enough but before engaging in satellite security testing, it is critical to reinforce OPSEC (Operational Security). All activities should be conducted within a controlled lab environment, using authorized test signals and simulations. Unauthorized testing on live satellite systems is highly illegal and prosecutable under international law. This training is provided for defensive research and educational purposes only.

Since the usual kali linux does not have all the necessary dependencies installed and it would take a very long time to install and configure them, we’ll be using DragonOS, is a Linux-based distro pre-configured with SDR (Software Defined Radio) tools. It includes essential programs such as Gqrx, GNURadio, Inspectrum, Baudline, HackRF tools, and SatDump, all of which are useful for signal analysis, jamming studies, and protocol reverse-engineering. You must also know that you must possess an SDR device (HackRF One, BladeRF, RTL-SDR, USRP and such), an antenna like high-gain dish, yagi or helical (the RTL-SDR default antenna is ok-ish but not great, you’ll want to upgrade that in the future).

Keep in mind that for the the Jamming attack we need a power amplifier.

Optional you may want a LNA (Low Noise Amplifier) to improve weak signal reception and a GPSDO (GPS Disciplined Oscillator) for precise frequency stability, there are good but not required. Once the hardware is assembled, connect the SDR and install the necessary drivers (rtl-sdr, hackrf-tools, uhd-host for USRP).

Jamming

Jamming is the most rudimentary but effective method of satellite disruption, it can be classified into downlink jamming (DoS for Receivers) or uplink jamming (Control channel disruption).

The Downlink jamming works by injecting high-powered RF interference directly into the satellite’s transmission frequency, degrading the signal-to-noise ratio and rendering legitimate communications unreadable.

To do so, all we have to do is to identify the target satellite and frequency, we need to visualize the signal from the satellite, generate a broadband noise signal and direct the transmission towards the target footprint. This disrupts GPS or satellite receivers within range. To do this attack, you need to have a powerful amplifier.

For the Uplink Jamming, this one is more severe as it prevents the satellite operators from communicating with their satellites. This can be achieved in a few simple steps:

Identify the frequency, configure the SDR transmitter settings, deploy a high-gain directional antennas and monitor for disruption in telemetry signals. This will conduct to operators losing control of the satellite leading to mission failure.

Eavesdropping

While jamming attacks focus on disrupting signals, eavesdropping takes a different approach. Instead of blocking communication, attackers attempt to stealthily intercept satellite transmissions, often without the sender or receiver even knowing.

The eavesdropping attack is a passive interception of satellite communication, as I mention in the previous edition, it is legal to listen to communications, it is illegal to transmit, jam or decrypt encrypted communication, although every country have different regulations so you might want to check out your own country policy regarding listening before doing it so you won’t end up in troubles.

This attack can be performed in different ways, depending upon which satellite system you want to listen, Iridium, SATCOM and so on.

If we were to intercept the SATCOM signal for example, we would need to identify the frequency of course, use baudline tool for AM/FM/SSB demodulation and then extract or decode the digital signals.

Hijacking and controlling a satellite

Full satellite takeover is rare but has been observed in real-world cyberwarfare incidents, such as the suspected Iranian takeover of U.S. military drones. The most practical method of hijacking typically involves targeting the satellite’s ground control infrastructure, as attacking the orbital hardware itself is significantly more difficult. A successful compromise of a ground station could allow adversaries to inject unauthorized telemetry data, override legitimate commands, or even assume control over the satellite’s trajectory and communication links.

Some satellites allow uplink command authentication via simple CRC checks instead of full cryptographic validation, so if we were to execute an RF-Based control hijack attack, we would have to reverse-engineer authentication protocols from intercepted command packets, we would need to generate forged command packets with a modified SDR transmitter then send the packets on the proper command uplink frequency, by doing this we would get the full command of the satellite, we could reposition it, shut it down or even make it collide or reenter the atmosphere and destroy it.

You might have noticed that explicit commands and tools were left out, this is mainly because these attacks are illegal, performing them could and will lead to serios consequences, however, as mentioned before, we as cyberwarriors we must be aware of the “dark side” too in order to prevent it, it is not wrong having knowledge however it’s how you choose to use it, makes the difference.

While these techniques expose significant vulnerabilities, the future of satellite security is evolving, governments and space agencies are implementing Quantum encryption for SATCOM links, adaptive frequency hopping to mitigate jamming and AI-driven intrusion detection systems for ground stations however, despite these improvements, the reality is that many legacy satellites remain vulnerable, and critical military and commercial infrastructure still depends on systems that are decades old since these satellites were never developed with cybersecurity in mind, every satellite in orbit is basically a computer and just like here on earth, any computer is hackable no matter if it’s in Europe, America, Asia or 35000 km from earth.

Understanding these vulnerabilities is not just about awareness, it’s about defense. For every exposed weakness, there must be an equal and opposing countermeasure. The future of satellite security depends not on secrecy, but on the ability of ethical cyberwarriors to anticipate, mitigate, and ultimately neutralize these threats before adversaries can exploit them.

Don't miss out the next edition of Journey of a Cyberwarrior where you'll never know where the battlefield will take you.

Stay strong, stay sharp and stay dedicated, never stop learning, never stop believing!

Until next time warriors!