Cyberthieves hit European Space Agency, stealing hundreds of gigabytes of data

The Dark Side of Space Exploration: Cyberthieves Hit European Space Agency

The European Space Agency (ESA) has recently suffered a string of cyberattacks that have leaked hundreds of gigabytes of potentially sensitive data onto dark web forums. The agency has responded by launching a criminal investigation against the unknown hackers, but a leading space cybersecurity researcher warns that many such attacks have previously gone unnoticed and that sensitive data, including email credentials of ESA and NASA employees, are frequently offered for sale on dark web forums.

The First Breach: A Trove of Data Dumped Online

On Boxing Day, reports emerged of a trove of data containing the agency's proprietary software, authorization credentials, access tokens, and sensitive project documentation being publicly accessible online. A hacker operating under the code name 888 dumped his cyber loot of more than 200 gigabytes on a dark web forum. The ESA quickly minimized the breach, saying its impact was "limited," but only a week after that statement was made, The Register revealed that a cybercrime group known as Scattered Lapsus$ Hunters stole another 500 gigabytes of data from the agency, claiming the security hole was still unpatched.

The Second Breach: Operational Procedures and Spacecraft Details Exposed

The second batch of data included operational procedures, spacecraft and mission details, subsystems documentation, and proprietary contractor data from ESA partners including SpaceX, Airbus Group, and Thales Alenia Space, according to The Register. This breach is particularly concerning, as it exposes sensitive information that could potentially be used to compromise the security of ESA's space missions.

The Investigation: A Partnership Between ESA and Authorities

The ESA has launched a criminal investigation into the breach, which is currently underway. The agency is fully cooperating with the authorities, who will manage the communication regarding the case and be in charge of the criminal proceedings. This partnership between the ESA and the authorities is crucial in ensuring that the investigation is thorough and effective.

The Cybersecurity Threat: A Growing Concern for Space Agencies

Cybersecurity researcher Clémence Poirier, of the Center for Security Studies at ETH Zurich, told Space.com that cyberattacks against space agencies are not isolated incidents. In fact, she said that during her research, she frequently encounters email credentials of ESA employees as well as other space agencies being sold online on dark web forums. This highlights the growing concern of cybersecurity threats to space agencies and the need for robust security measures to protect sensitive data.

The Infostealer Malware: A Sneaky Threat

Poirier added that threat actors may have obtained credentials through infostealer malware, which can harvest web-browser-stored data, including credentials, session cookies, multi-factor authentication data, saved credit cards, etc. Infostealers are an insidious type of malware that can evade detection by anti-virus software, making them a significant threat to space agencies.

The Rise of Cyberattacks Against Space Agencies

Another source familiar with the space cyber risk environment who didn't wish to be named said that space agencies are a common target of cyber attacks. NASA, especially, is a frequent victim of hackers, with vulnerabilities being disclosed "almost every day" via the crowdsourced cybersecurity platform BugCrowd. This highlights the need for space agencies to prioritize cybersecurity and invest in robust security measures to protect sensitive data.

The Implications: A Strategic Risk to Space Systems

Poirier added that, although the content of the recent leaks "did not seem highly critical," it could be combined in the future with data stolen in subsequent breaches to "reveal strategic information that could enable another cyberattack against a space system." This highlights the strategic risk to space systems and the need for space agencies to take proactive measures to protect sensitive data.

The Forward-Looking Thoughts: A Call to Action

The recent cyberattacks against the ESA highlight the growing concern of cybersecurity threats to space agencies. It is essential for space agencies to prioritize cybersecurity and invest in robust security measures to protect sensitive data. This includes implementing robust security protocols, conducting regular security audits, and investing in cybersecurity research and development. By taking proactive measures, space agencies can mitigate the risk of cyberattacks and ensure the security of their space missions.

Conclusion

The recent cyberattacks against the ESA highlight the growing concern of cybersecurity threats to space agencies. It is essential for space agencies to prioritize cybersecurity and invest in robust security measures to protect sensitive data. By taking proactive measures, space agencies can mitigate the risk of cyberattacks and ensure the security of their space missions. The future of space exploration depends on it.

Source: https://www.space.com/space-exploration/esa-email-credentials-on-dark-web