Schneier on Security

Clive Robinson • September 9, 2020 12:41 PM

@ Bruce, ALL,

These unclassified directives are typically so general that it’s hard to tell whether they actually matter.

But even in all that “waffle” they still miss some quite important things…

As an easy to spot example take a look at section 2(c) “Positive Control” it sounds all well and good untill you know they have left out an important control class off of the list,

“and for the intended time period”

I know some will think,

but isn’t that covered by “at the intended time”

The answer is no, and the reason involves jamming and failing into some kind of “fail safe” condition.

Positive Control is not about individual commands it’s about over all actions that consist of one or more usually many individual commands.

To see the difference think about the over all action “make a cup of tea” it consists of a series of actual individual commands such as “pick up kettle”, “put kettle on stove”, “turn on heat” etc. But importantly there are “action verifiers” that is after “pick up kettle” you should have a “test” of “Is there sufficcient water in the kettle?”. Thus an “action” is like a small program that has to be sent upto the vehicle via some kind of EM link that an attacker can jam at any point.

But ensuring the entire over all action gets sent to the vehical is insufficient for the notion of fail safe operating. In space when it comes to any kind of work such as moving something whilst there is inertia there is not in human terms any meaningful friction. Thus you have to perform both of the “equal and opposite actions”. To do both requires that you know that things will be not just available but usable in advance of starting any over all action. Thus not only do you have to check the ammount of propellent, you also have to check it is usable all before you start any action.

But whilst it’s easy for a human to correct for errors when making a cup of tea, think instead of a battery powered robot doing it. Most satellites for reasons of safety do not carry Radio Thermoeletric Generators (RTGs) any longer and they tend to use solar pannels that charge batteries that are little different to those you used to buy in your local Radio Shack / Tandy / Maplines 20years ago (such is the joy of space qualified parts). Thus you have a couple of issues just the same as you do with RTGs which is they have half lifes. So with Solar the panel will only give half the output power to the bus and the bateries will only hold half the power they did 200 charge cycles etc that they did before. But… Due to the way they work measuring what the actual available power is, is difficult (crudely think of the decreasing capacity as being the same as having a resistance in series that goes up in value with usage within the device but you can not measure across just the resistance).

The problem is that unless you have multiple buses you have to run everything of the one power bus. So if as an attacker I can see you starting a power hungry action I can cause other things to draw power. If the power drops to much on the power bus then you get a brown out which cascades and could cause you to start an action but not be able to complete it.

Thus if you are “station keeping” and need to increase your orbit hight (via an efficient Hohmann transfer orbit) I could let you do the first orbit change (periapsis burn) but not the second (apoapsis burn), or I could cause eirher burn to be too short or too long and the vehicle would be at the very least an undesirable eliptic orbit. Endangering mission usability, solar power collection, or worse still other orbital vehicals.

You can see what effect this would have by looking at,

https://en.wikipedia.org/wiki/Hohmann_transfer_orbit

Thus ensuring actions happen “at the right time for the right duration all the way through to compleation” or “not at all” is the basis of space vehicle “fail safe” operation. Thus designing the system such that it does so can be quite complex. It’s hard enough to do this when not considering jamming of control / telemetry channels, it becomes very fundemental to the entire design when you do and “Needs to be built in from day zero”.

Which means most satellites that are up currently could be vulnerable, and some that will get launched in the next three to seven years likewise may well be vulnerable because they are too far along the design process. So with 25year mission times vulnerable vehicles will probably still be in use in 2050 or later.

Clive Robinson • September 9, 2020 2:45 PM

@ jcb,

They have to justify a budget to Congress.

And you forgot the all important,

Wallpaper what they talk out of 😉