The Achilles Heel of Space-Based Systems: APIs are Easy to Hack

Application programming interfaces, or APIs, are the “Rosetta Stone” of IT, letting different software programs talk to each other and users to authenticate across different systems.

APIs are also one of the keystones of new space, enabling satellite operators to remotely control their vehicles through a cloud-based API-powered dashboard, explained Alissa Knight, a self-described “recovering hacker,” who was recruited by the U.S. Intelligence Community after being arrested.

“When you’re actually talking about telemetry, about sending commands to a satellite, ‘I want you to turn and take a picture of this area.’ Those are actually being delivered by APIs,” said Knight, who is now CEO of Assail, a venture-backed cybersecurity company building agentic AI swarms to test the cybersecurity of enterprise systems.

And APIs are the Achilles’ heel of space systems, she told attendees at the CyberSat conference last week, because they are riddled with software vulnerabilities.

Knight’s demonstration showed her small AI swarm finding and exploiting Broken Object Level Authorization, or BOLA vulnerabilities. In a satellite management dashboard, BOLA vulnerabilities might allow a logged-in (authenticated) user authorized to manage one satellite, to take control of other satellites.

“We do a really good job at authenticating, and a really terrible job at authorization,” Knight said, “BOLA is a type of authorization attack, and is probably 98% of the vulnerabilities I find in APIs.”

The attack Knight demonstrated employed a “bearer token” which was issued by the dashboard once she’d logged on. Because of BOLA, that token also allowed her to direct other satellites.

“There was a bearer token that was issued to me … I’m scoped for one satellite, but I can access any satellite in the constellation,” she said, as her AI swarm took command.

There are several reasons why the same BOLA vulnerabilities tend to surface again and again, Knight told Via Satellite in an interview.

“The answer is not simple, she acknowledged. The growth of agentic coding produces enterprise software riddled with vulnerabilities, she pointed out. But the speed at which code is shipped now is another factor, “We are shipping code so fast now. What used to take months is now just being done in like 12 or 24 hours.”

Finally, Knight argued, “We’re not shifting left in security, meaning that as we are writing the code, we should be actually doing the security testing while the code is being written, and we’re not doing that.”