Romel Marín is a Senior Hacker and Aerospace Cybersecurity Researcher with over a decade of experience in offensive operations. He has executed complex penetration testing assessments for diverse industries and Fortune 500 companies. Currently, he specializes in applying offensive methodologies to aerospace technologies, satellite protocols, and artificial intelligence. Romel is an external collaborator for the SPARTA (Space Attack Research & Tactics Analysis) framework and serves as a co-founder of the DEF CON Costa Rica group (DC11506). A speaker at international conferences such as Black Hat, DEF CON, TyphoonCON, Bsides, Ekoparty, and more, his work focuses on the security analysis of orbital infrastructure and mission-critical communications.
Insecure by Orbit: Vulnerability Research and Command Injection in LEO Space-Link Protocols
The rapid commercialization of Low Earth Orbit (LEO) has led to a massive deployment of SmallSat constellations that prioritize rapid development over robust security architectures. This research presents a deep-dive into the technical vulnerabilities of the Consultative Committee for Space Data Systems (CCSDS) protocol stack—the industry standard for space-to-ground communications.
We demonstrate how implementation flaws in the space-link layer, specifically the lack of frame-integrity validation and predictable sequence counters, allow for unauthorized Uplink Command Injection. By reverse-engineering mission-specific Opcodes from downlink telemetry using Software Defined Radio (SDR), we show how an adversary can achieve a “”Mission Kill”” without exploiting traditional memory corruptions.
To validate these findings, we introduce a high-fidelity, open-source hardware testbed designed to replicate the architectural vulnerabilities found in operational 1U CubeSat missions. This session provides the community with the first accessible framework to perform low-level auditing of orbital C2 (Command and Control) logic, exfiltrate sensitive mission data, and manipulate critical subsystems like the Electronic Power System (EPS) via radio.