Unverified COTS hardware enables persistent attacks in small satellites via SpyChain

SpyChain demonstrates that unverified commercial off-the-shelf hardware in small satellites can enable persistent, multi-component supply chain attacks, using NASA’s NOS3 simulator to study the risk. The paper outlines five attack scenarios, ranging from single components with time or GNSS triggers to two-component tactics that coordinate via the software bus or hidden files to exfiltrate data.

It argues attackers can remain stealthy during testing and launch, activating only under mission-relevant conditions such as orbital insertion. The adversary model assumes a supply-chain insider or a nation-state actor who pre-loads malware and understands flight-software interfaces, with modest ground resources for receiving stolen data or commanding payloads; claims in the study describe these capabilities as feasible with current small-sat architectures.

According to NASA’s NOS3 simulation team, the research highlights vulnerabilities including weak runtime monitoring, lack of software bus authentication, and limited logging, and proposes mitigations such as runtime monitoring, strict inter-component authentication, and broader supply-chain verification. The work underscores the broader risk to sectors like telecom, defence, and navigation if these supply-chain weaknesses go unaddressed.