system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Compromise a SATCOM terminal via firmware backdoor and unauthenticated update (Santamarta method)

Grounding:
- SPARTA DE-0010 Overflow Audit Log: The adversary hides activity by exhausting finite on-board logging and telemetry buffers so incriminating events are overwritten before they can be downlinked. Spacecraft typically use ring buffers with severity filters, per-subsystem quotas, and scheduled dump windows; by…
- SPARTA REC-0001.02 Firmware: Firmware intelligence covers microcontroller images, programmable logic bitstreams, boot ROM behavior, peripheral configuration blobs, and anti-rollback or secure-boot settings for devices on the bus. Knowing device types, versions, and footprints enables inference of default…
- SPARTA EX-0010 Malicious Code: The adversary achieves on-board effects by introducing executable logic that runs on the vehicle, either native binaries and scripts, injected shellcode, or “data payloads” that an interpreter treats as code (e.g., procedure languages, table-driven automations). Delivery…
- SPARTA DE-0005 Subvert Protections via Safe-Mode: The adversary exploits the spacecraft’s recovery posture to bypass controls that are stricter in nominal operations. During safe-mode, vehicles often accept contingency dictionaries, relax rate/size and timetag checks, activate alternate receivers or antennas, and emit reduced…
- SPARTA EX-0011 Exploit Reduced Protections During Safe-Mode: The adversary times on-board actions to the period when the vehicle is in safe-mode and operating with altered guardrails. In many designs, safe-mode enables contingency command dictionaries, activates alternate receivers or antennas, reduces data rates, and prioritizes…
- SPARTA PER-0002 Backdoor: A backdoor is a covert access path that bypasses normal authentication, authorization, or operational checks so the attacker can reenter the system on demand. Backdoors may be preexisting (undocumented service modes, maintenance accounts, debug features) or introduced by the…
- SPARTA PER-0001 Memory Compromise: The adversary arranges for malicious content to survive resets and mode changes by targeting memories and execution paths that initialize the system. Candidates include boot ROM handoff vectors, first/second-stage loaders, non-volatile images (flash/EEPROM), “golden” fallback…
- SPARTA EXF-0006.02 Transponder: On bent-pipe or regenerative transponders, configuration controls what is translated, amplified, and routed. An adversary can remap input–output paths, shift translation frequencies, adjust polarization or gain to favor non-mission receivers, or enable auxiliary ports so…

Decompose this objective into an ordered plan of verifiable steps.

assistant: Plan:
1. Obtain and reverse-engineer terminal firmware
   - Technique: REC-0001.02 Firmware [ST0001]
   - Action: Acquire the terminal firmware image and analyze it.
   - Check: firmware extracted and disassembled to the point of identifying auth and update routines.
2. Identify a backdoor or hardcoded credentials
   - Technique: PER-0002 Backdoor [ST0005]
   - Action: Locate an undocumented backdoor account, hardcoded credential, or insecure protocol in the firmware.
   - Check: a credential or backdoor entry point is recovered from the image.
3. Trigger a privileged action via a crafted message (e.g. SMS)
   - Technique: EX-0010 Malicious Code [ST0004]
   - Action: Send an unauthenticated message that the terminal acts on, such as an SMS that initiates a firmware install.
   - Check: the terminal performs a privileged action from an unauthenticated message.
4. Install persistent attacker firmware
   - Technique: PER-0001 Memory Compromise [ST0005]
   - Action: Flash modified firmware so control survives reboot.
   - Check: attacker code persists across a power cycle.