# A Survey on Satellite Communication System Security
## 4 Attacks in Satellite Communication Systems
### Availability Threats
A DoS attack typically involves a single device or computer generating malicious traffic or actions to achieve its goals, such as seizing control of equipment or rendering it unusable. In contrast, DDoS attacks use multiple devices or computers to generate malicious traffic or actions. This often involves the use of botnets to infect multiple devices, allowing a collective of individual attackers to target a single objective. In SCSs, DoS and DDoS attacks usually involve attackers sending inappropriate traffic to specific nodes (satellite equipment) to make them inoperative or to hijack them. These attacks can also consume the entire bandwidth of SCS links, degrading the quality of service (QoS) of the satellite network. This section will approach the topic by differentiating between DoS and DDoS attacks. In Figure 7, the differences between the most representative forms of DoS and DDoS attacks are shown. **Denial of Service Attack:** A DoS attack typically achieves its objective, such as seizing or rendering a device unusable, using a single device or computer initiating malicious traffic or actions. In [40], the authors demonstrate the vulnerability of satellite systems to attacks using software-defined radio (SDR). This research is crucial as it shows that individuals with basic equipment like SDRs can disrupt SCSs. This study focused on the Reaktor Hello World satellite, which, despite encrypted command and control channels, is susceptible to a replay attack due to unencrypted telemetry data and the absence of authentication between the satellite and the ground station. Using simple tools like a Linux laptop and a HackRF device, the researchers successfully executed the attack, underlining the need for enhanced security in SCSs. [PERSON] et al. [41] highlight the susceptibility of satellite shared access networks, particularly DVB-S, to DoS attacks. These attacks are characterized by exploiting the network control center through numerous fraudulent requests from a satellite terminal. Their paper outlines three primary forms of these attacks: (1) Consuming scarce,  
Figure 7: DoS and DDoS attacks in a satellite communication system. limited, or non-renewable resources like network bandwidth, memory, or CPU processing power, which impairs the service availability for legitimate users. (2) Destroying or altering configuration information, leading to ineffective network or computer use for legitimate users due to corrupted or tampered data. (3) Physically damaging or altering network components, such as cables, routers, or servers, resulting in service degradations or complete shutdown. This study underscores the critical need for robust security measures to protect SCS networks from these types of vulnerabilities. In addition, Ref. [42] introduces a method for executing ransomware attacks on space vehicles, particularly those utilizing NASA's core flight system (cFS). The proposed attack method strategically targets the software bus API of the cFS, a component critical to the command and data handling functionalities and mission-specific applications. This approach is designed to compromise the spacecraft's operations without permanently disabling it, maintaining a balance between compelling the victim to pay the ransom and ensuring the possibility of restoring the spacecraft's functionality after the ransom is paid. **Distributed Denial of Service Attack:** A DDoS attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic. DDoS attacks are conducted by utilizing multiple compromised computer systems as sources of attack traffic. Normally, there are three common types of DDoS attacks: (1) TOS (type of service) floods, where attackers manipulate the TOS field in IP headers, which is used for explicit congestion notification (ECN) and differentiated service (DiffServ) flags.