Chinese Hacked NASA In March: What's Stopping Chinese Hackers From Hacking Martian Probe?

NASA’s Curiosity rover has now been on the surface of Mars for just over a week. It hasn’t moved an inch after landing, instead focusing on orienting itself (and NASA’s scientists) by taking instrument readings and snapping images of its surroundings. The first beautiful full-color images of Gale Crater are starting to trickle in, and NASA has already picked out some interesting rock formations that it will investigate further in the next few days (pictures below). Over the weekend and continuing throughout today, however, Curiosity is attempting something very risky indeed: A firmware upgrade.

As we covered last week, at the heart of Curiosity there is a computer that runs VxWorks — a popular embedded operating system that is installed in millions of devices around the world, including many spacecraft, aircraft, the Apple Airport Extreme, Drobo storage devices, and Honda’s ASIMO robot. The VxWorks firmware on any of these systems, including Curiosity, can be updated at any time by uploading a new image and executing a few commands.

In the case of Curiosity, the new firmware was actually transmitted to the rover while it hurtled through space on its 8-month journey to Mars. On Saturday, Sol 5, NASA mission control transmitted the command that begun the update process. “We’ll tell it to activate a sequence to start the load, then we go out of contact [with the rover] and it’s gone for about eight hours,” says Steve Scandore, a senior flight software engineer at NASA’s Jet Propulsion Laboratory, to Computerworld. “We start the upgrade. It will perform a series of steps and then it will turn itself off. It will wake itself up the next day and there’s a down link to see what was done the day before.” We should know later today if the upgrade process has been successful. Similar firmware upgrades have been performed before: Both the Spirit and Opportunity Mars rovers had their software updated in 2007 (both were powered by VxWorks), and Voyager 2, which is currently 9 billion miles from Earth, had its firmware fixed in 2010.

As for why NASA is executing the world’s most risky firmware update on a computer that’s 250 million miles away from Earth, get this: They’re replacing Curiosity’s operating system with a version that’s more optimized for exploring the surface of Mars. At launch, Curiosity was loaded up with software that specialized in guiding the spacecraft to Mars and performing the complex EDL (entry, descent, landing) procedure. Now that Curiosity has landed, the guidance computer is no longer required — and so it’s being replaced with software that improves autonomy; more powerful computer vision, pathfinding, instrument analysis, and so on.

Hacking Curiosity

All of this led me to an interesting thought: What’s to stop other people from sending firmware updates to Curiosity? There have been many examples of amateur (and possibly state) actors misusing orbiting satellites — so why should Curiosity be any different? The short answer is, it isn’t.

In theory, Curiosity is hackable — and it wouldn’t even be all that hard.

The first approach would involve the would-be hacker building the equivalent of NASA’s Deep Space Network (DSN), a worldwide network of big-dish antenna that send and receive spacecraft signals, and perform radio astronomy. To perform uplink communications (to the rover), the DSN’s biggest antennae — 230-feet (70-meter) dishes — are outfitted with transmitters that deliver up to 400 kilowatts of output power. The hacker would also have to replicate the exact same encoding scheme (probably QPSK, the same as satellite TV) and use the same frequency (X band, around 8GHz).

With enough careful observation of NASA’s own transmissions, and full reverse engineering of the communication protocol and the rover’s command format, a hacker could gain access to Curiosity with his own antenna. Realistically, though, this approach could only be pulled off by a well-funded terrorist group or state-funded agency.

A much easier approach would be to hack into NASA and use its infrastructure to take over Curiosity. In theory, you could break into mission control at NASA’s Jet Propulsion Lab and issue your own commands via the DSN antennae. Likewise, you could physically break into mission control and upload some new firmware (which, of course, like a generic action movie, you’re carrying on a seemingly innocuous USB stick).

Back in March, NASA announced that it was the victim of 47 advanced persistent threat (APT) attacks, 13 of which gave Chinese hackers access to NASA’s internal network [PDF]. In one case, the login credentials of 150 NASA employees were stolen, which could later be used to access other secure systems. In another attack, the hackers gained complete control of a NASA system, allowing them to delete or modify files, upload hacking tools, and modify system logs to conceal their actions.