Silent Subversion: Sensor Spoofing Attacks via Supply Chain Implants in Satellite Systems

TL;DR

This paper demonstrates a novel internal satellite spoofing attack via compromised supply chain components, revealing a critical security vulnerability in satellite telemetry that threatens mission integrity and requires new countermeasures.

Contribution

It introduces the first end-to-end demonstration of onboard satellite spoofing through supply chain implants, highlighting a previously overlooked threat vector.

Findings

Rogue software successfully spoofed telemetry accepted by ground station

Attack compromised onboard estimators and ground operator views

Proposed countermeasures include telemetry authentication and component attestation

Abstract

Spoofing attacks are among the most destructive cyber threats to terrestrial systems, and they become even more dangerous in space, where satellites cannot be easily serviced, and operators depend on accurate telemetry to ensure mission success. When telemetry is compromised, entire spaceborne missions are placed at risk. Prior work on spoofing has largely focused on attacks from Earth, such as injecting falsified uplinks or overpowering downlinks with stronger radios. In contrast, onboard spoofing originating from within the satellite itself remains an underexplored and underanalyzed threat. This vector is particularly concerning given that modern satellites, especially small satellites, rely on modular architectures and globalized supply chains that reduce cost and accelerate development but also introduce hidden risks. This paper presents an end-to-end demonstration of an internal satellite spoofing attack delivered through a compromised vendor-supplied component implemented in NASA's NOS3 simulation environment. Our rogue Core Flight Software application passed integration and generated packets in the correct format and cadence that the COSMOS ground station accepted as legitimate. By undermining both onboard estimators and ground operator views, the attack directly threatens mission integrity and availability, as corrupted telemetry can bias navigation, conceal subsystem failures, and mislead operators into executing harmful maneuvers. These results expose component-level telemetry spoofing as an overlooked supply-chain vector distinct from jamming or external signal injection. We conclude by discussing practical countermeasures-including authenticated telemetry, component attestation, provenance tracking, and lightweight runtime monitoring-and highlight the trade-offs required to secure resource-constrained small satellites.