Technology
PUBLISHED
A team of cyber researchers, assisted by artificial intelligence, say they've found a security flaw in NASA's command-issuing system for spacecraft and other instruments. According to the team from Cycode, the flaw could have been used by hackers to issue arbitrary commands to humanity's various space-faring missions, with a few relatively simple steps.
NASA and other space organizations don't simply blast off into space, to study Mars, for example, and then wait patiently for the craft to return to check out its data. The US space agency is in regular contact, where orbital dynamics will allow, with its spacecraft, largely via the Near and Deep Space Networks.
NASA uses the Python-based AMMOS Instrument Toolkit (AIT) to talk to spacecraft and receive data back from them. The part a human sees when issuing these commands, the Graphical User Interface (GUI), is known as AIT-GUI, and it is here where Cycode, with the assistance of AI, found a fairly worrying security flaw.
Though no evidence has been presented to suggest this flaw was ever actually exploited, it could theoretically have allowed nefarious actors (or people who, god bless them, really really want to hijack a spacecraft for purely benevolent purposes) to issue their own commands without authentication.
"There is no auth middleware, no session/login requirement, no CSRF token, and no CORS restriction on any route," NASA-AMMOS explained of one part of the exploit in a github update. "Every state-changing endpoint below accepts application/x-www-form-urlencoded bodies, which are CORS 'simple' requests and therefore reachable cross-origin from a browser without a preflight."
"No step requires a memory-corruption primitive, an auth bypass, or a novel exploit technique," Cycode added. "It is four well-understood web weaknesses composed against a very high-value target."
According to NASA, an attacker could have used the flaw to issue "arbitrary commands" and run their own scripts. If a genuine AIT-GUI user had visited a malicious webpage, that would have been enough for hacker folk to start messing around in space.
"Because the listener is hardcoded to 0.0.0.0, the API is exposed to the whole reachable network regardless of the configured host," NASA adds, "and because the endpoints are browser-reachable cross-origin, even a host-local/firewalled deployment is exploitable if an operator with browser access to the GUI visits a malicious web page."
In an update reported in Infosecurity Magazine, NASA confirmed it had now resolved the vulnerability with a new patch, and it will continue to monitor and evaluate its systems for further potential risks. While not the main thing, the discovery of the weakness is notable for having used AI.
"This bug was found the way we think most real research will be done from here on: a human researcher working alongside AI-assisted code analysis," cycode added. "The tool does the tireless part — reading an unfamiliar codebase end to end and surfacing suspicious shapes — and the researcher does the judgment part: deciding which leads are real, confirming exploitability, and building a proof."
A similar bug in NASA software was found by a separate company using AI last November and has also since been fixed.
Given that no spacecraft appear to have been following commands other than those issued by NASA, and the exploit was found by a team who wants to get it fixed, everyone appears to have gotten lucky, this time, at least.
1