# Is the International Space Station “hackable”?

I was recently rereading this previous question of mine:

What would happen if a mutiny occurred on the International Space Station?

As I was considering different contingencies, the thought occurred to me that Mission Control locking out the crew members from the systems might not be effective if the ISS is "hackable".

Consider the unlikely scenario in which the crew of the International Space Station (ISS) decides to mutiny and ally with China. Mission Control locks out the crew from the controls, but then the crew hacks the ISS to regain control. China, as their partner, promises to send resources in lieu of the regular deliveries.

Maybe it is impossible for the crew to regain control from aboard the station, but there is another possible scenario: someone hacks remote control.

Consider in the above unlikely scenario if instead of the crew hacking the ISS, China hacked remote control of the ISS in cooperation with the mutinied crew.

Is either type of "hacking" the ISS possible? If so, how difficult would each be to pull off?

-
We are able to create something that is perfect, but we are not able to confirm whether that creation is perfect. – M. Mimpen Jul 10 '14 at 10:57
@aeron that argument is bizarrely teleological. My bicycle was built by humans, and it isn't hackable. Whether or not it's perfect has no relationship to whether or not it's hackable. – Racheet Jul 10 '14 at 13:06
@Racheet Your bicycle is also not electronic, which is a requirement for hackable. – TankorSmash Jul 10 '14 at 14:55
@TankorSmash arguably the ISS might be completely isolated from outside systems, which is also a requirement for hackable. We went to space doing our calculations using bits of rope in the apollo missions. Being subject to hacking is not a pre-requisite for "containing Humans in space" – Racheet Jul 10 '14 at 15:28

Wikipedia contains some information about the computer systems which control the ISS. Short version is: it is a mess.

Apparently, some modules have their own systems and communication frameworks. Internally, WiFi is used. The "key systems" are documented to run Debian Linux, while they previously used Windows -- which means that these systems are basically PC, and run common operating systems. As such, they must also have the same vulnerabilities. I also expect that they don't get patched for security fixes on a regular basis. So the bottom-line is that the ISS should be highly "hackable" -- provided that the attacker gains some access to the communication network of the ISS. Hacking into the ISS from the ground would imply penetrating one of the two communication networks which link the ISS to the external world (the American TDRSS and the Russian Lira).

On-board astronauts should find it easy to take full control of the ISS systems, because it is highly improbable that these PC are physically shielded (shielding is weight, and weight is very expensive when talking about orbital things). Also there is a big Tradition in human space exploration (and human exploration in general) to keep the local human in control of things -- that's the reason why we send humans and not chimpanzees in orbit. In that sense, the ISS crew cannot "hack into" the ISS computers because they already have full control.

Gaining control of the ISS system would not buy much to any attacker. At best, they could spread some local mayhem, probably kill the crew or threaten to do so if some ransom is not paid (e.g. by swinging the robotic arm into the hull, or sabotaging the oxygen inflow, or using the the ISS orbital control engines to precipitate it down to the atmosphere, or playing some Britney Spears at full volume in the audio system). Though an atmospheric reentry may fail to burn the complete station, targeting a precise area with the debris seems overly difficult, and the impact energy would not be high, so a subverted ISS would not account for a plausible orbital bombardment weapon.

To summarize: hack into the ISS, yeah, but what for ? It is not a boat; it cannot be made to land anywhere. Its strategic military value is nil. The ISS is good for Science and Public Relations, but very useless otherwise.

-
You ask "hack into the ISS, yeah, but what for?" and then you answer it nicely: "The ISS is good for Science and Public Relations". The public relations of "The US's national heros just defected to China" is worth more than anything China would have to invest to make that happen. – dotancohen Jul 9 '14 at 19:05
playing some Britney Spears at full volume in the audio system - Best laugh I had in days! – Lord Zsolt Jul 9 '14 at 19:11
@Jack no, ISS could not practically used to take down sattelites, it's orbit is much, much too far away from common sattelite orbits to be practically reachable using the available fuel and engines. And if ISS can reach a particular sattelite, it would be a ridiculously complex operation for such a small goal; existing ground-based weapon systems can do it much faster, cheaper, simpler and on a mass scale, and China has some experience in doing so. – Peteris Jul 9 '14 at 22:25
I'm certain the use of Britney Spears would contravene Atricle 3 of the Geneva Conventions. – rossmcm Jul 10 '14 at 3:43
'it cannot be made to land anywhere' Actually, I'd say you can - only once, and spectacularly so... – lbotinelly Jul 10 '14 at 12:14

Probably. The ISS has been infected with computer viruses multiple times. You can read about it here.

This was not the first instance of malware being transported to the space station, as other reports note that as early as 2008, another Russian astronaut had brought a laptop running Windows XP that was infected with the W32.Gammima.AG worm which quickly spread to other systems running the same operating system.

If an attacker manages to infect an astronaut's PC with a malware, it can easily be transported to the space station and since the space station uses known operating systems, infection is plausible. The challenging part might be to cause physical damage without knowing the details about the hardware and the control systems but that won't be a problem if it's a state sponsored espionage but like Thomas Pornin said, there is no point in doing it.

-